Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1542040
MD5:	871613f87b479fee14b7d6b4650b22e9
SHA1:	fd2bf53c3ce819dc9ab01c2160c07f1d9dcf6648
SHA256:	891e1d77f016b4219c06e50bacd3083e8b69f56124bfe903bcc66f5775c96d8b
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7040 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 871613F87B479FEE14B7D6B4650B22E9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["eaglepawnoy.store", "clearancek.site", "dissapoiznw.store", "spirittunek.store", "studennotediw.store", "mobbipenju.store", "bathdoomgaz.store", "licendfilteo.site"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:49:06.171442+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	60081	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:49:05.950823+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	50903	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:49:06.143929+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	50225	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:49:06.132593+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	61576	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:49:06.196265+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	60561	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:49:06.119098+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	57686	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:49:06.184335+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	50545	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:49:06.157529+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	51125	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:49:08.128882+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.7040.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["eaglepawnoy.store", "clearancek.site", "dissapoiznw.store", "spirittunek.store", "studennotediw.store", "mobbipenju.store", "bathdoomgaz.store", "licendfilteo.site"], "Build id": "4SD0y4--legendaryy"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.store
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.store
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.store
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.store
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.store
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.store
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009150FA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_008DD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_008DD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_009163B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00915700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_009199D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_0091695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_008DFCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_008E0EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00916094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_008D1000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_0090F030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_008E6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00914040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_008FD1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_008E42FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_008F2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_008F2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_009023E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_009023E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_009023E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_009023E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_009023E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_009023E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_008DA300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_009164B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_008FE40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_008EB410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00911440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_008ED457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_008FC470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_008F9510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00917520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_008E6536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0090B650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_008FE66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_008FD7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_009167EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00917710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_008F28E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_008D49A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00913920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_008ED961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_008E1ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_008E1A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00914A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_008D5A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00900B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_008E1BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_008E3BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_008EDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_008EDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00919B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_008FAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_008FAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_008FCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_008FCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_008FCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00919CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00919CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_008F7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_0090FC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_008FEC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00918D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_008FFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_008FDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_008E1E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_008D6EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_008E6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_008DBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_008E4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_008FAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_008F7E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_008F5E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_008E6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00915FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00917FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00917FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_008EFFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_008D8FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0090FF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_008F9F62

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:60561 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:57686 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:50903 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:61576 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:60081 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:51125 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:50225 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:50545 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: licendfilteo.site

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C42cb6563c5fec8103907e3e99aebe27b; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=6e5351e9bfb3747d76dfbaf5; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26105Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 25 Oct 2024 11:49:07 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/api
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apii
Source: file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761779203.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX
Source: file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api
Source: file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store:443/api
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761779203.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900s
Source: file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.1760172381.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759982030.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.1760172381.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C42cb6563c5fec81
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/apid
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E0228	0_2_008E0228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094	0_2_00AAA094
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091A0D0	0_2_0091A0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAF0FE	0_2_00AAF0FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D1000	0_2_008D1000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA5025	0_2_00AA5025
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E2030	0_2_008E2030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00914040	0_2_00914040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008DE1A0	0_2_008DE1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D71F0	0_2_008D71F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D5160	0_2_008D5160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009082D0	0_2_009082D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009012D0	0_2_009012D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D12F7	0_2_008D12F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008DB3A0	0_2_008DB3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D13A3	0_2_008D13A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009023E0	0_2_009023E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008DA300	0_2_008DA300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E4487	0_2_008E4487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E049B	0_2_008E049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009064F0	0_2_009064F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA34C2	0_2_00AA34C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093E450	0_2_0093E450
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008FC470	0_2_008FC470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D35B0	0_2_008D35B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008EC5F0	0_2_008EC5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B2568	0_2_009B2568
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009186F0	0_2_009186F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAD6D6	0_2_00AAD6D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0090F620	0_2_0090F620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D164F	0_2_008D164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00918652	0_2_00918652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009657FD	0_2_009657FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0090E8A0	0_2_0090E8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0090B8C0	0_2_0090B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4886B	0_2_00A4886B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00901860	0_2_00901860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F098B	0_2_008F098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009189A0	0_2_009189A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A8A959	0_2_00A8A959
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00918A80	0_2_00918A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5AAB3	0_2_00A5AAB3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00917AB0	0_2_00917AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA6AE1	0_2_00AA6AE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA1A1A	0_2_00AA1A1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00914A40	0_2_00914A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9ABE2	0_2_00A9ABE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D7BF0	0_2_008D7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AABB72	0_2_00AABB72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008EDB6F	0_2_008EDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00916CBF	0_2_00916CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093ECD8	0_2_0093ECD8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008FCCD0	0_2_008FCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00918C02	0_2_00918C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B31DF5	0_2_00B31DF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008FFD10	0_2_008FFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008FDD29	0_2_008FDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8D62	0_2_008F8D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E6EBF	0_2_008E6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008DBEB0	0_2_008DBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E4E2A	0_2_008E4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008FAE57	0_2_008FAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00918E70	0_2_00918E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3BFA5	0_2_00A3BFA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00917FC0	0_2_00917FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D8FD0	0_2_008D8FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008DAF10	0_2_008DAF10

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 008ED300 appears 152 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 008DCAA0 appears 48 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9994907693894389

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@9/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00908220 CoCreateInstance,

0_2_00908220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: }RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeRTZP

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior

Source: file.exe

Static file information: File size 3010048 > 1048576

Source: file.exe

Static PE information: Raw size of aijfxohi is bigger than: 0x100000 < 0x2b5800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.8d0000.0.unpack :EW;.rsrc :W;.idata :W;aijfxohi:EW;fzttnmtx:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;aijfxohi:EW;fzttnmtx:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2df30d should be: 0x2e7088

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: aijfxohi
Source: file.exe	Static PE information: section name: fzttnmtx
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3B0BF push edx; mov dword ptr [esp], ecx	0_2_00B3B0E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3B0BF push 09EFEAE4h; mov dword ptr [esp], eax	0_2_00B3B0FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F808C push ebx; mov dword ptr [esp], eax	0_2_009F80DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8908F push ebx; mov dword ptr [esp], edx	0_2_00B89108
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push 26EED300h; mov dword ptr [esp], ebx	0_2_00AAA09C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push 5F808D68h; mov dword ptr [esp], esp	0_2_00AAA0BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push edx; mov dword ptr [esp], edi	0_2_00AAA130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push edi; mov dword ptr [esp], 41167125h	0_2_00AAA13C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push edi; mov dword ptr [esp], esi	0_2_00AAA182
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push 72D64D36h; mov dword ptr [esp], ebp	0_2_00AAA18A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push 45D158C1h; mov dword ptr [esp], ebx	0_2_00AAA208
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push ebp; mov dword ptr [esp], ebx	0_2_00AAA236
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push ecx; mov dword ptr [esp], edi	0_2_00AAA24D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push eax; mov dword ptr [esp], edx	0_2_00AAA377
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push ecx; mov dword ptr [esp], 2FDB39B5h	0_2_00AAA39B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push 1F2FEAB0h; mov dword ptr [esp], ebx	0_2_00AAA3AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push 5176327Ch; mov dword ptr [esp], eax	0_2_00AAA425
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push ebx; mov dword ptr [esp], eax	0_2_00AAA43C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push 77CAF949h; mov dword ptr [esp], edx	0_2_00AAA48D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push ebx; mov dword ptr [esp], edx	0_2_00AAA4D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push 12E12039h; mov dword ptr [esp], ebp	0_2_00AAA56B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push esi; mov dword ptr [esp], eax	0_2_00AAA604
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push 2BF3D0AAh; mov dword ptr [esp], esi	0_2_00AAA620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push edi; mov dword ptr [esp], 1043ECA4h	0_2_00AAA64C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push 095FE0B8h; mov dword ptr [esp], ebp	0_2_00AAA6E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push ebx; mov dword ptr [esp], eax	0_2_00AAA70B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push edx; mov dword ptr [esp], 1FFF1921h	0_2_00AAA754
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push eax; mov dword ptr [esp], ecx	0_2_00AAA841
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push 69894F95h; mov dword ptr [esp], esi	0_2_00AAA861
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push 3FC62AFCh; mov dword ptr [esp], ecx	0_2_00AAA923
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA094 push edi; mov dword ptr [esp], 0BEF13FAh	0_2_00AAA93F

Source: file.exe

Static PE information: section name: entropy: 7.982854283962191

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB40A2 second address: AB40B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 ja 00007F54C0F0A796h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB40B2 second address: AB40DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E8127h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F54C08E811Bh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB40DA second address: AB40DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA301D second address: AA3032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ebx 0x00000008 jnc 00007F54C08E8116h 0x0000000e jg 00007F54C08E8116h 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA3032 second address: AA303E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F54C0F0A796h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB31C0 second address: AB31CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB31CA second address: AB31CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB31CE second address: AB31D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB31D4 second address: AB31DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB362F second address: AB3649 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F54C08E8120h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3912 second address: AB3916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3916 second address: AB3944 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E8125h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F54C08E8125h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3944 second address: AB394A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6C9D second address: AB6CA7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F54C08E8116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6CA7 second address: AB6D12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jl 00007F54C0F0A798h 0x00000012 push edx 0x00000013 pop edx 0x00000014 jo 00007F54C0F0A7ADh 0x0000001a jmp 00007F54C0F0A7A7h 0x0000001f popad 0x00000020 mov eax, dword ptr [esp+04h] 0x00000024 jg 00007F54C0F0A7ACh 0x0000002a mov eax, dword ptr [eax] 0x0000002c push edx 0x0000002d push edx 0x0000002e jng 00007F54C0F0A796h 0x00000034 pop edx 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a jl 00007F54C0F0A7A0h 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6D55 second address: AB6D82 instructions: 0x00000000 rdtsc 0x00000002 je 00007F54C08E8116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edx, 454545E3h 0x00000013 movsx edi, cx 0x00000016 push 00000000h 0x00000018 sub dword ptr [ebp+122D2824h], edx 0x0000001e push 83A48F6Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 push esi 0x00000026 jnc 00007F54C08E8116h 0x0000002c pop esi 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6D82 second address: AB6E37 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F54C0F0A79Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 7C5B7114h 0x00000011 or dword ptr [ebp+122D2853h], ecx 0x00000017 push 00000003h 0x00000019 mov ecx, dword ptr [ebp+122D26DBh] 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push ebp 0x00000024 call 00007F54C0F0A798h 0x00000029 pop ebp 0x0000002a mov dword ptr [esp+04h], ebp 0x0000002e add dword ptr [esp+04h], 0000001Ah 0x00000036 inc ebp 0x00000037 push ebp 0x00000038 ret 0x00000039 pop ebp 0x0000003a ret 0x0000003b jmp 00007F54C0F0A79Fh 0x00000040 pushad 0x00000041 jmp 00007F54C0F0A79Fh 0x00000046 mov bx, si 0x00000049 popad 0x0000004a push 00000003h 0x0000004c push 00000000h 0x0000004e push ebx 0x0000004f call 00007F54C0F0A798h 0x00000054 pop ebx 0x00000055 mov dword ptr [esp+04h], ebx 0x00000059 add dword ptr [esp+04h], 0000001Bh 0x00000061 inc ebx 0x00000062 push ebx 0x00000063 ret 0x00000064 pop ebx 0x00000065 ret 0x00000066 xor edi, 61AD4B8Ch 0x0000006c jns 00007F54C0F0A798h 0x00000072 mov esi, edx 0x00000074 call 00007F54C0F0A799h 0x00000079 pushad 0x0000007a je 00007F54C0F0A798h 0x00000080 pushad 0x00000081 popad 0x00000082 push eax 0x00000083 push edx 0x00000084 push esi 0x00000085 pop esi 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6F53 second address: AB6F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6F57 second address: AB6F61 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F54C0F0A796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6F61 second address: AB6F66 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6F66 second address: AB6F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D20BCh], esi 0x00000010 stc 0x00000011 push 00000000h 0x00000013 sub dword ptr [ebp+122D2818h], ecx 0x00000019 mov dword ptr [ebp+122D1E63h], ecx 0x0000001f push BB5DBF5Dh 0x00000024 push eax 0x00000025 push edx 0x00000026 js 00007F54C0F0A79Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6F94 second address: AB6F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6F98 second address: AB7009 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C0F0A7A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 44A24123h 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007F54C0F0A798h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a movzx edx, si 0x0000002d push 00000003h 0x0000002f push 00000000h 0x00000031 or dword ptr [ebp+122D2772h], ecx 0x00000037 push 00000003h 0x00000039 jnl 00007F54C0F0A79Ch 0x0000003f push B5E7BF95h 0x00000044 pushad 0x00000045 pushad 0x00000046 push esi 0x00000047 pop esi 0x00000048 pushad 0x00000049 popad 0x0000004a popad 0x0000004b pushad 0x0000004c pushad 0x0000004d popad 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB70AF second address: AB70B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB70B5 second address: AB70D6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 movzx edi, si 0x0000000c push 00000000h 0x0000000e mov esi, 554E4217h 0x00000013 push 948F3CD7h 0x00000018 push edi 0x00000019 js 00007F54C0F0A79Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB70D6 second address: AB711D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 add dword ptr [esp], 6B70C3A9h 0x0000000c adc cx, 91ACh 0x00000011 push 00000003h 0x00000013 sub dword ptr [ebp+122D2936h], ebx 0x00000019 push 00000000h 0x0000001b mov ecx, 221AA1C4h 0x00000020 push 00000003h 0x00000022 jmp 00007F54C08E8128h 0x00000027 call 00007F54C08E8119h 0x0000002c push esi 0x0000002d push esi 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5121 second address: AD5126 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5126 second address: AD5130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5130 second address: AD5138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5138 second address: AD5143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5418 second address: AD542E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C0F0A7A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5596 second address: AD55B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E8121h 0x00000007 jmp 00007F54C08E811Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD55B8 second address: AD55D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F54C0F0A7A4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD55D5 second address: AD55DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5736 second address: AD575A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F54C0F0A7A7h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD575A second address: AD576A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F54C08E811Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD58D7 second address: AD58DD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD58DD second address: AD58EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F54C08E811Ch 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD58EF second address: AD58F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5BD3 second address: AD5BF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F54C08E8116h 0x0000000a jmp 00007F54C08E8124h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5BF1 second address: AD5C05 instructions: 0x00000000 rdtsc 0x00000002 js 00007F54C0F0A796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F54C0F0A796h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD613E second address: AD614A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F54C08E8116h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD614A second address: AD616A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F54C0F0A79Bh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 popad 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jno 00007F54C0F0A796h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD616A second address: AD6174 instructions: 0x00000000 rdtsc 0x00000002 js 00007F54C08E8116h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACDF99 second address: ACDF9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACDF9F second address: ACDFA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD62B6 second address: AD62C5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F54C0F0A796h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6B0D second address: AD6B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jne 00007F54C08E8116h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6F1A second address: AD6F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F54C0F0A7A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD9A62 second address: AD9A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBCDF second address: ADBCE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBCE3 second address: ADBCE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBCE9 second address: ADBCEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0EAD second address: AE0ED1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F54C08E8116h 0x00000010 jmp 00007F54C08E8124h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0ED1 second address: AE0EEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C0F0A7A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0EEF second address: AE0EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0EF3 second address: AE0F12 instructions: 0x00000000 rdtsc 0x00000002 je 00007F54C0F0A796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F54C0F0A7A3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4607 second address: AE4631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F54C08E8129h 0x00000009 push eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4631 second address: AE4642 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop esi 0x00000008 pushad 0x00000009 jno 00007F54C0F0A796h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4642 second address: AE4648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA80A1 second address: AA80B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop ebx 0x00000008 jo 00007F54C0F0A7DFh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA80B3 second address: AA80B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA80B7 second address: AA80BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3B17 second address: AE3B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3C4C second address: AE3C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F54C0F0A796h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F54C0F0A796h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3F2A second address: AE3F34 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F54C08E8116h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE41C9 second address: AE41D1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE41D1 second address: AE41DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE41DA second address: AE41E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4477 second address: AE4499 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F54C08E8116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F54C08E811Eh 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jc 00007F54C08E8116h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4499 second address: AE449E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7094 second address: AE709F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F54C08E8116h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE709F second address: AE70AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7628 second address: AE7686 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E811Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F54C08E8118h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 push edx 0x00000027 xor dword ptr [ebp+122D2768h], ebx 0x0000002d pop esi 0x0000002e add si, 7D93h 0x00000033 nop 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 jmp 00007F54C08E8129h 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7686 second address: AE768B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7736 second address: AE773A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE773A second address: AE7744 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F54C0F0A796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7744 second address: AE774A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE774A second address: AE774E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7855 second address: AE7859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7859 second address: AE785F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7A19 second address: AE7A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98B14 second address: A98B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98B18 second address: A98B24 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98B24 second address: A98B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98B28 second address: A98B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE96B7 second address: AE96BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE96BB second address: AE96CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E811Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE96CD second address: AE96D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F54C0F0A796h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEEB2E second address: AEEB7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jg 00007F54C08E8118h 0x0000000b popad 0x0000000c nop 0x0000000d stc 0x0000000e push 00000000h 0x00000010 jmp 00007F54C08E811Dh 0x00000015 push 00000000h 0x00000017 mov esi, dword ptr [ebp+122D38F2h] 0x0000001d xchg eax, ebx 0x0000001e jmp 00007F54C08E811Dh 0x00000023 push eax 0x00000024 ja 00007F54C08E812Fh 0x0000002a pushad 0x0000002b jmp 00007F54C08E8121h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF57C second address: AEF586 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F54C0F0A79Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF339 second address: AEF33E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEFFF6 second address: AF0000 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F54C0F0A796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0000 second address: AF0006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0006 second address: AF008E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F54C0F0A79Ch 0x0000000e nop 0x0000000f jmp 00007F54C0F0A7A2h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F54C0F0A798h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 adc di, 6B56h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007F54C0F0A798h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 00000014h 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 jp 00007F54C0F0A796h 0x00000057 jl 00007F54C0F0A79Bh 0x0000005d mov edi, 26FF6936h 0x00000062 xchg eax, ebx 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF008E second address: AF0092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF30B9 second address: AF30CA instructions: 0x00000000 rdtsc 0x00000002 je 00007F54C0F0A796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF30CA second address: AF30CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF30CE second address: AF30EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C0F0A7A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF30EE second address: AF3130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov ebx, dword ptr [ebp+122D203Eh] 0x0000000d push 00000000h 0x0000000f jc 00007F54C08E8119h 0x00000015 movsx ebx, di 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F54C08E8118h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D2A06h], edx 0x0000003a xchg eax, esi 0x0000003b pushad 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3130 second address: AF3136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3136 second address: AF313F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF4F77 second address: AF4F8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C0F0A7A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3388 second address: AF338E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF338E second address: AF3392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7DD7 second address: AF7DFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F54C08E8116h 0x00000009 jmp 00007F54C08E8121h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jng 00007F54C08E8116h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF42EA second address: AF42EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF42EE second address: AF42F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF511D second address: AF5185 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a jmp 00007F54C0F0A79Bh 0x0000000f pop ecx 0x00000010 nop 0x00000011 push dword ptr fs:[00000000h] 0x00000018 xor dword ptr [ebp+122D2D88h], esi 0x0000001e mov dword ptr [ebp+1246029Fh], ecx 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b jnl 00007F54C0F0A7A0h 0x00000031 mov bh, 8Ah 0x00000033 mov eax, dword ptr [ebp+122D0361h] 0x00000039 mov bx, cx 0x0000003c push FFFFFFFFh 0x0000003e jbe 00007F54C0F0A7A0h 0x00000044 pushad 0x00000045 mov cx, ax 0x00000048 sub ax, 9E46h 0x0000004d popad 0x0000004e push eax 0x0000004f pushad 0x00000050 jng 00007F54C0F0A79Ch 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6FB5 second address: AF704A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F54C08E811Ch 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 jmp 00007F54C08E811Dh 0x00000015 mov bh, 7Eh 0x00000017 push dword ptr fs:[00000000h] 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007F54C08E8118h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 mov ebx, esi 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 push 00000000h 0x00000043 push eax 0x00000044 call 00007F54C08E8118h 0x00000049 pop eax 0x0000004a mov dword ptr [esp+04h], eax 0x0000004e add dword ptr [esp+04h], 00000017h 0x00000056 inc eax 0x00000057 push eax 0x00000058 ret 0x00000059 pop eax 0x0000005a ret 0x0000005b mov eax, dword ptr [ebp+122D08EDh] 0x00000061 jne 00007F54C08E811Dh 0x00000067 push FFFFFFFFh 0x00000069 nop 0x0000006a pushad 0x0000006b pushad 0x0000006c js 00007F54C08E8116h 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6016 second address: AF601A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7F4A second address: AF7F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF704A second address: AF7079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F54C0F0A7A6h 0x0000000b jnc 00007F54C0F0A796h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 jl 00007F54C0F0A7A0h 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF601A second address: AF601E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAC35 second address: AFAC3A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7F4E second address: AF7F5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF601E second address: AF6028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAC3A second address: AFACA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F54C08E811Ah 0x0000000d nop 0x0000000e and ebx, 7B5D0DA5h 0x00000014 push 00000000h 0x00000016 movsx ebx, cx 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007F54C08E8118h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 add ebx, dword ptr [ebp+122D1E7Dh] 0x0000003b xchg eax, esi 0x0000003c push ecx 0x0000003d jmp 00007F54C08E8126h 0x00000042 pop ecx 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jc 00007F54C08E8118h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6028 second address: AF602C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF9C87 second address: AF9C96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F54C08E811Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF9C96 second address: AF9CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F54C0F0A79Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8F15 second address: AF8F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF9D71 second address: AF9D82 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F54C0F0A796h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE29D second address: AFE2A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE2A4 second address: AFE2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F54C0F0A79Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B011FC second address: B01201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01201 second address: B0125D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b or di, 1F61h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F54C0F0A798h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c mov edi, eax 0x0000002e mov bx, B893h 0x00000032 push 00000000h 0x00000034 jmp 00007F54C0F0A79Dh 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F54C0F0A7A4h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0125D second address: B01262 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B021C4 second address: B021C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B021C8 second address: B021CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B021CE second address: B021DC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B021DC second address: B021E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B021E3 second address: B02264 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C0F0A7A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F54C0F0A798h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D3421h], ebx 0x0000002a push 00000000h 0x0000002c adc di, 1885h 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebp 0x00000036 call 00007F54C0F0A798h 0x0000003b pop ebp 0x0000003c mov dword ptr [esp+04h], ebp 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc ebp 0x00000049 push ebp 0x0000004a ret 0x0000004b pop ebp 0x0000004c ret 0x0000004d jmp 00007F54C0F0A7A1h 0x00000052 push eax 0x00000053 push edi 0x00000054 push edi 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFD5AD second address: AFD5B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE433 second address: AFE445 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F54C0F0A798h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF414 second address: AFF471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b movzx edi, ax 0x0000000e push dword ptr fs:[00000000h] 0x00000015 mov dword ptr fs:[00000000h], esp 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007F54C08E8118h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 mov eax, dword ptr [ebp+122D08F9h] 0x0000003c movzx ebx, cx 0x0000003f push FFFFFFFFh 0x00000041 jmp 00007F54C08E811Ch 0x00000046 push eax 0x00000047 jl 00007F54C08E8124h 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE445 second address: AFE463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F54C0F0A7A9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF471 second address: AFF477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B030F4 second address: B030FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE560 second address: AFE564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE564 second address: AFE568 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE568 second address: AFE574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0148E second address: B01493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01493 second address: B0149D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F54C08E8116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B032D8 second address: B032DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B090C8 second address: B090CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAD1B4 second address: AAD1C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAD1C3 second address: AAD1C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B14510 second address: B14514 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B145D2 second address: B145D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A004 second address: B1A008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A284 second address: B1A2A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E8123h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A2A1 second address: B1A2A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A2A5 second address: B1A304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F54C08E8127h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push ebx 0x0000000e jmp 00007F54C08E8123h 0x00000013 pop ebx 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 jmp 00007F54C08E8123h 0x0000001c push edx 0x0000001d pop edx 0x0000001e jmp 00007F54C08E811Fh 0x00000023 popad 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A304 second address: B1A311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnp 00007F54C0F0A7A9h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A880 second address: B1A895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F54C08E8116h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F54C08E8118h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A895 second address: B1A89B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A89B second address: B1A89F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A89F second address: B1A8A5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF10EE second address: AF10F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF10F2 second address: ACDF99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C0F0A79Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F54C0F0A798h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 lea eax, dword ptr [ebp+12490EF3h] 0x0000002a mov edi, dword ptr [ebp+122D365Ah] 0x00000030 push eax 0x00000031 jnp 00007F54C0F0A7A0h 0x00000037 pushad 0x00000038 js 00007F54C0F0A796h 0x0000003e push eax 0x0000003f pop eax 0x00000040 popad 0x00000041 mov dword ptr [esp], eax 0x00000044 mov dword ptr [ebp+12481C02h], edx 0x0000004a add dword ptr [ebp+122D2471h], ecx 0x00000050 call dword ptr [ebp+122D2A13h] 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 js 00007F54C0F0A796h 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1674 second address: AF1678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF18A5 second address: AF18C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp], esi 0x00000009 sub dword ptr [ebp+1245605Bh], ebx 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jne 00007F54C0F0A796h 0x00000018 jp 00007F54C0F0A796h 0x0000001e popad 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1990 second address: AF1994 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1BB7 second address: AF1BBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1BBB second address: AF1BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1BC1 second address: AF1BDE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov edi, eax 0x0000000b mov edx, dword ptr [ebp+122D296Dh] 0x00000011 push 00000004h 0x00000013 and di, 3636h 0x00000018 push eax 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1BDE second address: AF1BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F54C08E8116h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F54C08E8122h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF233E second address: AF23A3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F54C0F0A79Bh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e pushad 0x0000000f jmp 00007F54C0F0A7A3h 0x00000014 mov dx, 7B82h 0x00000018 popad 0x00000019 lea eax, dword ptr [ebp+12490EF3h] 0x0000001f jno 00007F54C0F0A7A6h 0x00000025 push eax 0x00000026 pushad 0x00000027 jmp 00007F54C0F0A7A6h 0x0000002c push eax 0x0000002d push edx 0x0000002e push edx 0x0000002f pop edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF23A3 second address: ACEA71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E8124h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+12456FF0h], edi 0x00000013 call dword ptr [ebp+122D3453h] 0x00000019 jmp 00007F54C08E811Dh 0x0000001e push esi 0x0000001f jl 00007F54C08E811Ch 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E2E8 second address: B1E304 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F54C0F0A79Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F54C0F0A79Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24823 second address: B24858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F54C08E8116h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push esi 0x0000000e jng 00007F54C08E8116h 0x00000014 pushad 0x00000015 popad 0x00000016 pop esi 0x00000017 pop eax 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F54C08E8124h 0x00000020 jne 00007F54C08E8116h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24858 second address: B2485C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23E4B second address: B23E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24CD4 second address: B24CD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA14D9 second address: AA14F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F54C08E8123h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA14F2 second address: AA14F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31A07 second address: B31A38 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F54C08E8116h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F54C08E8127h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 jl 00007F54C08E8116h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3077E second address: B30784 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30CFE second address: B30D02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30E98 second address: B30E9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30FDF second address: B31013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 jmp 00007F54C08E8128h 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F54C08E8122h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31013 second address: B31018 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31149 second address: B3117E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jbe 00007F54C08E8116h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F54C08E811Fh 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 jo 00007F54C08E8116h 0x0000001c jc 00007F54C08E8116h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 jg 00007F54C08E8116h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3117E second address: B31184 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3144D second address: B31458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F54C08E8116h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31458 second address: B31464 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 je 00007F54C0F0A796h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31822 second address: B3182A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3182A second address: B31833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31833 second address: B31852 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F54C08E8126h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31852 second address: B31858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30240 second address: B30246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30246 second address: B3024A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3024A second address: B3024E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3464D second address: B34657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34955 second address: B3495B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3495B second address: B34976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F54C0F0A7A4h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37182 second address: B37186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37186 second address: B371C6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F54C0F0A7A9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007F54C0F0A7A0h 0x00000011 pop ebx 0x00000012 pushad 0x00000013 jmp 00007F54C0F0A79Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B36D46 second address: B36D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F54C08E8122h 0x0000000b jnc 00007F54C08E811Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F54C08E8123h 0x00000018 jng 00007F54C08E8116h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B36D85 second address: B36D8B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B36EC4 second address: B36ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B36ECA second address: B36ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B1D9 second address: B3B1DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B1DD second address: B3B1E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F54C0F0A796h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B333 second address: B3B337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B337 second address: B3B33B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B33B second address: B3B366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007F54C08E8116h 0x0000000d jmp 00007F54C08E8127h 0x00000012 jng 00007F54C08E8116h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B366 second address: B3B396 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C0F0A79Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F54C0F0A7A7h 0x0000000e jmp 00007F54C0F0A79Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B64D second address: B3B673 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F54C08E8121h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jne 00007F54C08E8118h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B673 second address: B3B677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B94B second address: B3B962 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F54C08E811Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3BAB7 second address: B3BABC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B411F8 second address: B411FD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B411FD second address: B4121B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e jns 00007F54C0F0A79Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4121B second address: B41225 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F54C08E8116h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B414B4 second address: B414B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B414B8 second address: B414D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E8128h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B414D6 second address: B414DB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41630 second address: B41636 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41927 second address: B4192D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4192D second address: B41931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41931 second address: B41963 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F54C0F0A79Ch 0x0000000c jmp 00007F54C0F0A7A1h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jno 00007F54C0F0A796h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4239A second address: B423DB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F54C08E8118h 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop edx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007F54C08E8129h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jmp 00007F54C08E8121h 0x0000001f jbe 00007F54C08E8126h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B423DB second address: B423E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jng 00007F54C0F0A796h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44D72 second address: B44D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44D78 second address: B44D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F54C0F0A79Bh 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F54C0F0A796h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44D94 second address: B44D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44F26 second address: B44F2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B453BB second address: B453C7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B453C7 second address: B453CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B453CD second address: B453E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E811Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DA5C second address: B4DA75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F54C0F0A79Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F54C0F0A796h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C009 second address: B4C025 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E811Eh 0x00000007 jl 00007F54C08E8116h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C025 second address: B4C029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C029 second address: B4C02F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C60C second address: B4C624 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F54C0F0A79Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C8DE second address: B4C903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F54C08E8126h 0x0000000e jbe 00007F54C08E8116h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4CBED second address: B4CC00 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F54C0F0A79Ch 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4CC00 second address: B4CC29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F54C08E8122h 0x00000010 jmp 00007F54C08E811Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D226 second address: B4D22A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D22A second address: B4D22E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B509E3 second address: B509EE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 js 00007F54C0F0A796h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50B39 second address: B50B4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F54C08E811Ch 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50B4C second address: B50B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50B52 second address: B50B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F54C08E811Fh 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50B72 second address: B50B8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C0F0A79Eh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50B8C second address: B50B94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50B94 second address: B50B9B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50E55 second address: B50E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F54C08E811Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B51138 second address: B5113E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5113E second address: B51142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B51142 second address: B51148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B51148 second address: B51157 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E811Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B51157 second address: B51161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B51161 second address: B51165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B52FB3 second address: B52FC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F54C0F0A79Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B57831 second address: B5783B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F54C08E8116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F360 second address: B5F378 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F54C0F0A796h 0x00000008 js 00007F54C0F0A796h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jp 00007F54C0F0A7A2h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D965 second address: B5D976 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E811Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D976 second address: B5D99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F54C0F0A7A0h 0x0000000b popad 0x0000000c push eax 0x0000000d push ecx 0x0000000e jng 00007F54C0F0A796h 0x00000014 push edi 0x00000015 pop edi 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D99C second address: B5D9A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D9A0 second address: B5D9A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DB18 second address: B5DB2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F54C08E8122h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DC7E second address: B5DC82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DC82 second address: B5DC88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DC88 second address: B5DC8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DC8E second address: B5DCAE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jns 00007F54C08E8116h 0x00000009 je 00007F54C08E8116h 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007F54C08E811Ah 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DCAE second address: B5DCB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E2BB second address: B5E2BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E2BF second address: B5E2C9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F54C0F0A796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E2C9 second address: B5E2CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E2CF second address: B5E2D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E3F5 second address: B5E3F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E3F9 second address: B5E3FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E3FD second address: B5E413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F54C08E8116h 0x00000010 jc 00007F54C08E8116h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E413 second address: B5E417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EB4F second address: B5EB53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D162 second address: B5D166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66451 second address: B6647F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jno 00007F54C08E811Eh 0x0000000b js 00007F54C08E8137h 0x00000011 push esi 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F54C08E811Fh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6647F second address: B66485 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6670D second address: B66719 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F54C08E8116h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66719 second address: B6671D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74C6E second address: B74C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F54C08E8129h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74DB6 second address: B74DC7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F54C0F0A796h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d push ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B780F9 second address: B78109 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F54C08E8116h 0x00000008 jng 00007F54C08E8116h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78109 second address: B7810F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7810F second address: B78113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78264 second address: B7826C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7826C second address: B7828F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E8129h 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F54C08E8116h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7828F second address: B782AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C0F0A79Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jnp 00007F54C0F0A796h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B782AB second address: B782C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F54C08E811Dh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B782C1 second address: B782C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7D1D1 second address: B7D1DB instructions: 0x00000000 rdtsc 0x00000002 je 00007F54C08E8116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7E968 second address: B7E971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7E971 second address: B7E975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7E975 second address: B7E97B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B82EB3 second address: B82ECC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E8123h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B82ECC second address: B82ED3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89123 second address: B89152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F54C08E8128h 0x00000009 jbe 00007F54C08E8123h 0x0000000f jmp 00007F54C08E811Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89152 second address: B8916A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007F54C0F0A796h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F54C0F0A79Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8916A second address: B8916E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C29C second address: B8C2AA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F54C0F0A796h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94DBB second address: B94DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B95063 second address: B95069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B95333 second address: B95337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B95337 second address: B9533D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9533D second address: B9535F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F54C08E811Ch 0x0000000c jmp 00007F54C08E811Eh 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9535F second address: B9538F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F54C0F0A79Ah 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c jbe 00007F54C0F0A7A7h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 js 00007F54C0F0A7CEh 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9538F second address: B95395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B95395 second address: B953A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B953A0 second address: B953A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B96074 second address: B960AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C0F0A7A7h 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 jns 00007F54C0F0A796h 0x00000018 pop esi 0x00000019 jmp 00007F54C0F0A79Bh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B960AA second address: B960C2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F54C08E811Ch 0x00000008 je 00007F54C08E8116h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jnp 00007F54C08E8116h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B996CD second address: B996F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F54C0F0A7A8h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B996F8 second address: B99703 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AD74 second address: B9AD80 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F54C0F0A796h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AD80 second address: B9AD8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F54C08E8116h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9CCA5 second address: B9CCD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F54C0F0A796h 0x0000000a jmp 00007F54C0F0A79Ah 0x0000000f popad 0x00000010 jmp 00007F54C0F0A7A8h 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9CCD8 second address: B9CCDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9CCDF second address: B9CCEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jbe 00007F54C0F0A796h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9CCEB second address: B9CCF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9C9F0 second address: B9C9F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA91C6 second address: BA91EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jp 00007F54C08E8116h 0x0000000c popad 0x0000000d jmp 00007F54C08E8127h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8928 second address: BB892F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBBF01 second address: BBBF07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBBF07 second address: BBBF0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBBF0B second address: BBBF28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F54C08E8129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4ECD second address: BD4EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F54C0F0A79Ch 0x00000009 js 00007F54C0F0A796h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4EE4 second address: BD4F0A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jbe 00007F54C08E8116h 0x00000009 jmp 00007F54C08E8128h 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4F0A second address: BD4F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4F0E second address: BD4F12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3F41 second address: BD3F52 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F54C0F0A796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3F52 second address: BD3F56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3F56 second address: BD3F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F54C0F0A7A3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jno 00007F54C0F0A796h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3F78 second address: BD3F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3F7F second address: BD3F84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3F84 second address: BD3FA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 js 00007F54C08E8116h 0x0000000c jmp 00007F54C08E811Eh 0x00000011 popad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD43C3 second address: BD43DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F54C0F0A7A2h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD43DB second address: BD43E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD43E1 second address: BD43F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jbe 00007F54C0F0A796h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD46E1 second address: BD46F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F54C08E8116h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD46F0 second address: BD46F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD46F4 second address: BD46FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD481A second address: BD481E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4951 second address: BD4972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 jp 00007F54C08E8116h 0x0000000c jmp 00007F54C08E811Ah 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007F54C08E8116h 0x0000001a push edx 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD654C second address: BD655C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F54C0F0A79Eh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD655C second address: BD659E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 jmp 00007F54C08E8127h 0x0000000c jmp 00007F54C08E8127h 0x00000011 pop eax 0x00000012 push edx 0x00000013 jo 00007F54C08E8116h 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD659E second address: BD65A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80D63 second address: 4E80D67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80D67 second address: 4E80D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cx, di 0x00000009 popad 0x0000000a test ecx, ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ch, BFh 0x00000011 call 00007F54C0F0A79Fh 0x00000016 pop esi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80D89 second address: 4E80DA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F54C08E8125h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80DA2 second address: 4E80DA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80DA6 second address: 4E80DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F54C08E8174h 0x0000000e jmp 00007F54C08E811Dh 0x00000013 add eax, ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F54C08E8123h 0x0000001e jmp 00007F54C08E8123h 0x00000023 popfd 0x00000024 mov bh, cl 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80DF1 second address: 4E80E06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F54C0F0A7A1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80E06 second address: 4E80E0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80E0A second address: 4E80E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax+00000860h] 0x0000000e pushad 0x0000000f call 00007F54C0F0A7A3h 0x00000014 pushfd 0x00000015 jmp 00007F54C0F0A7A8h 0x0000001a xor cx, DFD8h 0x0000001f jmp 00007F54C0F0A79Bh 0x00000024 popfd 0x00000025 pop ecx 0x00000026 movsx ebx, si 0x00000029 popad 0x0000002a test eax, eax 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F54C0F0A79Eh 0x00000033 sbb al, 00000038h 0x00000036 jmp 00007F54C0F0A79Bh 0x0000003b popfd 0x0000003c movzx ecx, bx 0x0000003f popad 0x00000040 je 00007F5531C80675h 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F54C0F0A79Eh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEABFA second address: AEAC05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAC05 second address: AEAC13 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F54C0F0A796h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAE12 second address: AEAE18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAE18 second address: AEAE1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAE1D second address: AEAE23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAE23 second address: AEAE3F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007F54C0F0A7A9h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F54C0F0A79Bh 0x00000016 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9339EA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: ADBE87 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 931012 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B68D28 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 5828	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2104	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: file.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.1760172381.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000E75000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1760172381.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759982030.0000000000E73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761779203.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00915BB0 LdrInitializeThunk,

0_2_00915BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: bathdoomgaz.store
Source: file.exe	String found in binary or memory: spirittunek.store
Source: file.exe	String found in binary or memory: dissapoiznw.store
Source: file.exe	String found in binary or memory: studennotediw.store
Source: file.exe	String found in binary or memory: mobbipenju.store
Source: file.exe	String found in binary or memory: eaglepawnoy.store

Source: file.exe, 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: 5Program Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
eaglepawnoy.store	unknown	unknown	true	unknown
bathdoomgaz.store	unknown	unknown	true	unknown
spirittunek.store	unknown	unknown	true	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	true	unknown
mobbipenju.store	unknown	unknown	true	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
bathdoomgaz.store	true	unknown
studennotediw.store	true	unknown
clearancek.site	true	unknown
dissapoiznw.store	true	unknown
https://steamcommunity.com/profiles/76561199724331900	true	unknown
spirittunek.store	true	unknown
licendfilteo.site	true	unknown
eaglepawnoy.store	true	unknown
mobbipenju.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://studennotediw.store:443/apid	file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://player.vimeo.com	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bathdoomgaz.store:443/api	file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761779203.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steam.tv/	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://licendfilteo.site:443/api	file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX	file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/76561199724331900s	file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/	file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com	file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mobbipenju.store:443/api	file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C42cb6563c5fec81	file.exe, 00000000.00000003.1760172381.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clearancek.site:443/apii	file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://spirittunek.store:443/api	file.exe, 00000000.00000003.1759982030.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/	file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000000.00000003.1759982030.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759913506.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	file.exe, 00000000.00000002.1761873951.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;	file.exe, 00000000.00000003.1760172381.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759982030.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.1759913506.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/	file.exe, 00000000.00000002.1761961217.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542040
Start date and time:	2024-10-25 13:48:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@9/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
07:49:05	API Interceptor	3x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9FvJxhtNOD.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	https://docs.google.com/drawings/d/16aLMbL32wnhWFCR-cOQsVjZ_IjkqNuDyBIYT5G0hJjI/preview?pli=1M6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67n	Get hash	malicious	HTMLPhisher	Browse	23.38.98.97
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://ljptn9jl729v.jp.larksuite.com/share/base/form/shrjpAd28kd9HXI7TjO1wFqS7Pf	Get hash	malicious	Unknown	Browse	2.16.202.58
	9FvJxhtNOD.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	184.50.112.86
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	104.119.207.229
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	K3Kvd8JYGV.elf	Get hash	malicious	Unknown	Browse	104.118.46.106
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9FvJxhtNOD.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0	Get hash	malicious	Unknown	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.50300285353093
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'010'048 bytes
MD5:	871613f87b479fee14b7d6b4650b22e9
SHA1:	fd2bf53c3ce819dc9ab01c2160c07f1d9dcf6648
SHA256:	891e1d77f016b4219c06e50bacd3083e8b69f56124bfe903bcc66f5775c96d8b
SHA512:	62bc716d3fbd092d8614784f0f1add80b72342955edd74a1953b5e62bb73a9954950c49b9f2afa0e7782c5c13bfe818abfab094651354fb2ffda156745aed08a
SSDEEP:	49152:W278W1xOXT1Xp6bpLKBOTwCsmbXITW17aEOeYyHL:2WjiYbpGBcwubYA7ZOHyHL
TLSH:	13D549A7B446B1CFD48A1778B42BCD82999D02BA472498C3EC1D757E7EA3CC41AF5C24
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f.............................p1...........@...........................1.......-...@.................................W...k..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x717000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F54C06BD0EAh
bswap esp
sub eax, 00000000h
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	1d68143f75d230984d554f11f5c05933	False	0.9994907693894389	data	7.982854283962191	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
aijfxohi	0x60000	0x2b6000	0x2b5800	576ccd8ece4a1a0a5e2fce75470cc7ab	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fzttnmtx	0x316000	0x1000	0x400	9bd4de677d29c26d095ed71acf8c2d7e	False	0.69140625	data	5.583105626906505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x317000	0x3000	0x2200	fc0ffb999ba5d6a03c891148d120dc9e	False	0.0661764705882353	DOS executable (COM)	0.6998154366181721	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T13:49:05.950823+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	50903	1.1.1.1	53	UDP
2024-10-25T13:49:06.119098+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	57686	1.1.1.1	53	UDP
2024-10-25T13:49:06.132593+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	61576	1.1.1.1	53	UDP
2024-10-25T13:49:06.143929+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	50225	1.1.1.1	53	UDP
2024-10-25T13:49:06.157529+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	51125	1.1.1.1	53	UDP
2024-10-25T13:49:06.171442+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	60081	1.1.1.1	53	UDP
2024-10-25T13:49:06.184335+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	50545	1.1.1.1	53	UDP
2024-10-25T13:49:06.196265+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	60561	1.1.1.1	53	UDP
2024-10-25T13:49:08.128882+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 13:49:06.232359886 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:06.232446909 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:06.232861042 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:06.237114906 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:06.237190008 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:07.100367069 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:07.100528955 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:07.164822102 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:07.164887905 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:07.166043043 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:07.214704990 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:07.508802891 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:07.551354885 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:08.128958941 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:08.129020929 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:08.129076004 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:08.129098892 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:08.129137039 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:08.129246950 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:08.129246950 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:08.129246950 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:08.129312038 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:08.129399061 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:08.129483938 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:08.246822119 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:08.246893883 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:08.247046947 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:08.247229099 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:08.247229099 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:08.249435902 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:08.249495983 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 25, 2024 13:49:08.249536037 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 25, 2024 13:49:08.249553919 CEST	443	49730	104.102.49.254	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 13:49:05.950823069 CEST	50903	53	192.168.2.4	1.1.1.1
Oct 25, 2024 13:49:06.113018036 CEST	53	50903	1.1.1.1	192.168.2.4
Oct 25, 2024 13:49:06.119097948 CEST	57686	53	192.168.2.4	1.1.1.1
Oct 25, 2024 13:49:06.128654957 CEST	53	57686	1.1.1.1	192.168.2.4
Oct 25, 2024 13:49:06.132592916 CEST	61576	53	192.168.2.4	1.1.1.1
Oct 25, 2024 13:49:06.142071009 CEST	53	61576	1.1.1.1	192.168.2.4
Oct 25, 2024 13:49:06.143929005 CEST	50225	53	192.168.2.4	1.1.1.1
Oct 25, 2024 13:49:06.153876066 CEST	53	50225	1.1.1.1	192.168.2.4
Oct 25, 2024 13:49:06.157529116 CEST	51125	53	192.168.2.4	1.1.1.1
Oct 25, 2024 13:49:06.168057919 CEST	53	51125	1.1.1.1	192.168.2.4
Oct 25, 2024 13:49:06.171442032 CEST	60081	53	192.168.2.4	1.1.1.1
Oct 25, 2024 13:49:06.182142973 CEST	53	60081	1.1.1.1	192.168.2.4
Oct 25, 2024 13:49:06.184334993 CEST	50545	53	192.168.2.4	1.1.1.1
Oct 25, 2024 13:49:06.194313049 CEST	53	50545	1.1.1.1	192.168.2.4
Oct 25, 2024 13:49:06.196264982 CEST	60561	53	192.168.2.4	1.1.1.1
Oct 25, 2024 13:49:06.211040974 CEST	53	60561	1.1.1.1	192.168.2.4
Oct 25, 2024 13:49:06.217406988 CEST	60089	53	192.168.2.4	1.1.1.1
Oct 25, 2024 13:49:06.225387096 CEST	53	60089	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 13:49:05.950823069 CEST	192.168.2.4	1.1.1.1	0x78b	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.119097948 CEST	192.168.2.4	1.1.1.1	0x291e	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.132592916 CEST	192.168.2.4	1.1.1.1	0xa10	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.143929005 CEST	192.168.2.4	1.1.1.1	0xec90	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.157529116 CEST	192.168.2.4	1.1.1.1	0x3a89	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.171442032 CEST	192.168.2.4	1.1.1.1	0x4b41	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.184334993 CEST	192.168.2.4	1.1.1.1	0x700d	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.196264982 CEST	192.168.2.4	1.1.1.1	0x24e9	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.217406988 CEST	192.168.2.4	1.1.1.1	0x77b1	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 13:49:06.113018036 CEST	1.1.1.1	192.168.2.4	0x78b	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.128654957 CEST	1.1.1.1	192.168.2.4	0x291e	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.142071009 CEST	1.1.1.1	192.168.2.4	0xa10	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.153876066 CEST	1.1.1.1	192.168.2.4	0xec90	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.168057919 CEST	1.1.1.1	192.168.2.4	0x3a89	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.182142973 CEST	1.1.1.1	192.168.2.4	0x4b41	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.194313049 CEST	1.1.1.1	192.168.2.4	0x700d	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.211040974 CEST	1.1.1.1	192.168.2.4	0x24e9	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 13:49:06.225387096 CEST	1.1.1.1	192.168.2.4	0x77b1	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	7040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 11:49:07 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-25 11:49:08 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 25 Oct 2024 11:49:07 GMT Content-Length: 26105 Connection: close Set-Cookie: sessionid=6e5351e9bfb3747d76dfbaf5; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C42cb6563c5fec8103907e3e99aebe27b; Path=/; Secure; HttpOnly; SameSite=None
2024-10-25 11:49:08 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-25 11:49:08 UTC	11638	IN	Data Raw: 22 3f 6c 3d 74 63 68 69 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 63 68 69 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e7 b9 81 e9 ab 94 e4 b8 ad e6 96 87 20 28 54 72 61 64 69 74 69 6f 6e 61 6c 20 43 68 69 6e 65 73 65 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 6a 61 70 61 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6a 61 70 61 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e6 97 a5 e6 9c ac e8 aa 9e 20 28 4a Data Ascii: "?l=tchinese" onclick="ChangeLanguage( 'tchinese' ); return false;"> (Traditional Chinese)</a><a class="popup_menu_item tight" href="?l=japanese" onclick="ChangeLanguage( 'japanese' ); return false;"> (J

Target ID:	0
Start time:	07:49:00
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x8d0000
File size:	3'010'048 bytes
MD5 hash:	871613F87B479FEE14B7D6B4650B22E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	61.1%
Total number of Nodes:	54
Total number of Limit Nodes:	6

Executed Functions

Function 009150FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(19A41BB1,00000000,00000800), ref: 00915182

Strings

<I$), xrefs: 00915198
@^, xrefs: 00915120
<I$), xrefs: 009152E3

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: <I$)$<I$)$@^
API String ID: 1029625771-935358343
Opcode ID: 23a642587142e443812ce4bfbd260375f57d593db95a2c238ca985554340f753
Instruction ID: f6a656e8faeab8a6acecdeb31b8601e26a9b18d2c5cee9c080edbb47e4f76928
Opcode Fuzzy Hash: 23a642587142e443812ce4bfbd260375f57d593db95a2c238ca985554340f753
Instruction Fuzzy Hash: 5721CF3521C384CFC300DF68D88076AB7E4AB96300FAA882CE0C5D3361D635DA15CB46

Function 008DFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t, xrefs: 008DFCBE
J|BJ, xrefs: 008E000D
V, xrefs: 008DFEDC
VY^_, xrefs: 008DFDFF

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: d09987e3afed98b360b63cbbc98b740d49d95a5b52df3e68076eeb713ffb0d41
Instruction ID: 3d833ae9e347b2f8e45f8c9f5b9ae85f34c1726d33ed173f86c542d07a166b6a
Opcode Fuzzy Hash: d09987e3afed98b360b63cbbc98b740d49d95a5b52df3e68076eeb713ffb0d41
Instruction Fuzzy Hash: 56D164745083909BD310DF599490A1FBBE2FB96B48F188C2DF5C98B212C776C949EF92

Function 008DD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 008DD2F1

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3a253ab64ac941d086a27c67bd35835fb2a90207be7564041dc8ba20d64fcfbf
Instruction ID: 359b35f8d6650714cafb8179a5a86310685f075cd33300f85908e98add7d8d29
Opcode Fuzzy Hash: 3a253ab64ac941d086a27c67bd35835fb2a90207be7564041dc8ba20d64fcfbf
Instruction Fuzzy Hash: AF41237044D380ABD701BB68D584A2EFBE5EF92744F148E1DE5C8DB352C23AE8149B67

Function 00915700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00915784

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7bbe0ecfbd08c6f092c58409ec852aa1fe9ae6d31a84ed9d9a900fe8ee1133a1
Instruction ID: 3a2456f9ae84015e282bb562817bf0a954311c328a74a22b1fdd307cbe5d671b
Opcode Fuzzy Hash: 7bbe0ecfbd08c6f092c58409ec852aa1fe9ae6d31a84ed9d9a900fe8ee1133a1
Instruction Fuzzy Hash: D711A371A1C240EBC311AF18E845A5BBBF99FC6710F068C28E4C49B251D339D955CB93

Function 00915BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0091973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00915BDE

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0091695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 009169C5

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: d153bdb8a46b59344b8a5d75a5dcaf745634b29ade2cec8b68d705b4e39f29d4
Instruction ID: ad2afde42fc3d7c565645989bd5f2f3f9c051351b1deeaeffa86385f113dfe24
Opcode Fuzzy Hash: d153bdb8a46b59344b8a5d75a5dcaf745634b29ade2cec8b68d705b4e39f29d4
Instruction Fuzzy Hash: C831AAB0A183058FD718DF14D89076AB7F9EF85344F44881CE5C697261E3389984CB56

Function 008E049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 612ef0881f5b9371d0cf761690803b0282fd7fdb26efa95fd33736d43282792b
Instruction ID: 95bc5df9b747d829cc857a81383281c727a1f0575e75f2e1ce8360448ecce25c
Opcode Fuzzy Hash: 612ef0881f5b9371d0cf761690803b0282fd7fdb26efa95fd33736d43282792b
Instruction Fuzzy Hash: 37918975214B00CFD724CF25E8A0A26B7F6FF89314B118A6CE8968BAA1D770E815DF50

Function 008E0228 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70899ed506aaeda7e3a1c3e766c55e154c8cc4f6fa2ea325815386316f55fba2
Instruction ID: 20a34f4ccaa2f5293faa316eea8c2f0f9ba7482875c9706f84c39abfd66b3fe8
Opcode Fuzzy Hash: 70899ed506aaeda7e3a1c3e766c55e154c8cc4f6fa2ea325815386316f55fba2
Instruction Fuzzy Hash: 31718834214B04CFD725CF21E8A4A26B7F6FF8A314F118968E8868BA62C771A815DF50

Function 009199D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4e1930b2f18047c867506bac3b8016a61c380c0c25bfe6386a1b4a88e853ec
Instruction ID: e3dd9ded140102df91d161ce1747c7a9497880996e2f02450e4ef58eafb9eb1d
Opcode Fuzzy Hash: 3f4e1930b2f18047c867506bac3b8016a61c380c0c25bfe6386a1b4a88e853ec
Instruction Fuzzy Hash: A841D03438C308ABD724DB15E8A0B6BB7E9EF85710F54882CF58A87251D330EC81DB62

Function 009163B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d5281ab09b3598f28bf8a390f39bfb032a69d16d451e2ee2243049f150678d07
Instruction ID: ea293fa49f5f786d4e4f7196602c45969354420f0ab2d5671414bd346dbec69a
Opcode Fuzzy Hash: d5281ab09b3598f28bf8a390f39bfb032a69d16d451e2ee2243049f150678d07
Instruction Fuzzy Hash: A4310670B49305FBD624DB04CD81F7AB7AAFB81B10F64891CF181572E1D370A892DB52

Function 008E0EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fbeb255072da7a95029543d6da70af7e959fe9e7e261264da0840e800b80fcb
Instruction ID: 1e01292b5544dbaa0cea28eadf20bdca143951acf1c65031a7c6f65a79d7d115
Opcode Fuzzy Hash: 3fbeb255072da7a95029543d6da70af7e959fe9e7e261264da0840e800b80fcb
Instruction Fuzzy Hash: DA2148B4A0026A9FDF14CF95CC90BBEBBB1FB4A304F144818E411BB282C775A911CF64

Function 00913220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 009132A6

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 15bc4ce486ff4985dd95b603f56d8d8aff35bf692d86fc79e1d005ecd4bc56e6
Instruction ID: 54aa2415e7639d0f88fbaade6baf217cbcb0b9ef310cb2565e7ee54bf6952335
Opcode Fuzzy Hash: 15bc4ce486ff4985dd95b603f56d8d8aff35bf692d86fc79e1d005ecd4bc56e6
Instruction Fuzzy Hash: 7601467460D2409BC711EB18E885A1EBBF8EF8AB10F458D1CE5C58B361D239DD64DBA2

Function 00913202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00913208

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9706a41d998bea4d4934df14a4241268a46e4eac773128f969218df10965b951
Instruction ID: 82e5a7bf3f8d3996861f78c2a99c29cc70599d75ff03ad1a06bf36a5478ece4a
Opcode Fuzzy Hash: 9706a41d998bea4d4934df14a4241268a46e4eac773128f969218df10965b951
Instruction Fuzzy Hash: F2B012700500005FDA141B00EC0AF003514EF00605F800050A100040B1D1655965D554

Non-executed Functions

Function 008EDB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

|, xrefs: 008EECB1
dcba, xrefs: 008EE728
QNOL, xrefs: 008EE775
`Y^_, xrefs: 008EE99E
()./, xrefs: 008EE9CA
xgfe, xrefs: 008EE71D
`onm, xrefs: 008EE733
mjkh, xrefs: 008EE7D8
:WUE, xrefs: 008EF6B7, 008EF6C6
tuJK, xrefs: 008EE967
DCBA, xrefs: 008EE887, 008EE896
AR, xrefs: 008EDD10
89>?, xrefs: 008EE9F6
D, xrefs: 008EE846
<=:;, xrefs: 008EE930
lkji, xrefs: 008EE73E
@ONM, xrefs: 008EE6DB
89&', xrefs: 008EE93B
tsrq, xrefs: 008EE6FC
WP, xrefs: 008EDCEF
LKJI, xrefs: 008EE6E6
%*+(, xrefs: 008EDE37, 008EDE46
T, xrefs: 008EF157
<=2, xrefs: 008EEA01

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: 9af485afecd2c45c8a4ff6f678a7c3d922eb5b19b76c37edd0a6037b9f1724ad
Instruction ID: af7362f44a6588f5287cd15b3477a2aae40fd833e099df877ce9ca83a5cdf171
Opcode Fuzzy Hash: 9af485afecd2c45c8a4ff6f678a7c3d922eb5b19b76c37edd0a6037b9f1724ad
Instruction Fuzzy Hash: 84F255B05093C59BD770CF15C884BABBBE6FBD6304F14482DE5C98B292DB319985CB92

Function 009023E0 Relevance: 31.3, APIs: 4, Strings: 12, Instructions: 3298COMMON

Download Yara Rule

Strings

3<, xrefs: 009032D6
:, xrefs: 009032DD
mlc@, xrefs: 0090275C
`tii, xrefs: 00902693
|}&C, xrefs: 00902F21
ggxz, xrefs: 00902685
f@~!, xrefs: 009025FF
{l`~, xrefs: 0090268C
fedc, xrefs: 00902782
%*+(, xrefs: 009040EF
aenQ, xrefs: 0090276A
Cx, xrefs: 0090453D

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C
API String ID: 0-786070067
Opcode ID: 362cd836ef6a67198b7dae3ce6fc07dcd1efb1e81b48e52b7f0c0670ce188bac
Instruction ID: 3c3d123a43a89be33125ee8ec44613dab9eeebd591ca8a9b67ddbaf1146c630e
Opcode Fuzzy Hash: 362cd836ef6a67198b7dae3ce6fc07dcd1efb1e81b48e52b7f0c0670ce188bac
Instruction Fuzzy Hash: A533CD70504B81CFD7258F38C590762BBE5BF56304F58899DE4DA8BB92C736E806CBA1

Function 008F9F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

_Y, xrefs: 008FA641
Gt, xrefs: 008F9FF8
(a*c, xrefs: 008FA147
N[, xrefs: 008FA375
JG, xrefs: 008FAA27
sm, xrefs: 008FA830
?m,o, xrefs: 008FA13C
CG, xrefs: 008FAA32
hi, xrefs: 008FAB9D
WQ, xrefs: 008FA62B
/), xrefs: 008FA66D
=], xrefs: 008FA36A
]{, xrefs: 008FA1E7, 008FA1F3
WH, xrefs: 008FAA1C
S], xrefs: 008FA636
kW, xrefs: 008FA380
%e6g, xrefs: 008FA152

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 98fa00314885e8e2d0b25e335f309b2044080e175ba4d9ca03c27f6a1cc58b40
Instruction ID: ef785113007c63f6abdcdced51117537ad472d00405fbae4e31618e81705eb11
Opcode Fuzzy Hash: 98fa00314885e8e2d0b25e335f309b2044080e175ba4d9ca03c27f6a1cc58b40
Instruction Fuzzy Hash: 1252C6B404D3858AE274CF25D681B9EBAF1BB92740F608A1DE2ED9B255DB708045CF93

Function 008F9510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

G'M!, xrefs: 008F9ADB
T#a-, xrefs: 008F9AE3
;IJK, xrefs: 008F983E
8;, xrefs: 008F9B13
G+X5, xrefs: 008F9AF3
pq, xrefs: 008F99E0
X/R), xrefs: 008F9AEB
B7U1, xrefs: 008F9AFB
!E4G, xrefs: 008F9836
L3Y=, xrefs: 008F9B03
z=Q?, xrefs: 008F9826
B?Q9, xrefs: 008F9B0B
O+f), xrefs: 008F9634, 008F963D
?M0K, xrefs: 008F9968
2A"_, xrefs: 008F9980
,A&C, xrefs: 008F982E

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 7db1e26b341fcd8134dc64297c34429e1494fe91600b72812abf298a3d85ff8b
Instruction ID: 79a996e79bc7708919d077c143f93e454ec8c58adb3cea0fc199ec44a77ca412
Opcode Fuzzy Hash: 7db1e26b341fcd8134dc64297c34429e1494fe91600b72812abf298a3d85ff8b
Instruction Fuzzy Hash: 1AF140B4518388ABD310DF25D881A2BBBF4FB8AB48F544D1CF6D59B252D334D908CB96

Function 008FDD29 Relevance: 14.9, Strings: 11, Instructions: 1142COMMON

Download Yara Rule

Strings

,Q?S, xrefs: 008FE26F
{E, xrefs: 008FE323
-M2O, xrefs: 008FE25A
<Y.[, xrefs: 008FE27D
)IgK, xrefs: 008FE261
Y9N;, xrefs: 008FE245
hX]N, xrefs: 008FDDC7
n\+H, xrefs: 008FDDC0
upH}, xrefs: 008FDE8A, 008FE798, 008FDF4A
%*+(, xrefs: 008FE143
=]+_, xrefs: 008FE276

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$upH}${E
API String ID: 0-1557708024
Opcode ID: d193e0196d09f2b6334de070788c5d382079b0cba26fa9c7e3f7cb2805d5127d
Instruction ID: 9012d077949f7d2d3690afad90b0ef13f611d3ed4f4299b843df4e515c02febf
Opcode Fuzzy Hash: d193e0196d09f2b6334de070788c5d382079b0cba26fa9c7e3f7cb2805d5127d
Instruction Fuzzy Hash: 30921571E00219CFDB14CF68D8817AEBBB2FF99310F298169E551AB3A1D7359D12CB90

Function 00AAA094 Relevance: 11.6, Strings: 8, Instructions: 1593COMMON

Download Yara Rule

Strings

/N/, xrefs: 00AAAF5B
}{~, xrefs: 00AAAB7C
3s:, xrefs: 00AAA5D5
v0og, xrefs: 00AAB38B
N, xrefs: 00AAB391
BQ>, xrefs: 00AAA772
/N/, xrefs: 00AAAF3C
gjw_, xrefs: 00AAA410

Memory Dump Source

Source File: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: 3s:$BQ>$gjw_$v0og$/N/$/N/$}{~$N
API String ID: 0-817911370
Opcode ID: 2fd1f05b101e8520a732a57a3fa589fd867a2ba9aefb81dc0cc5f72372d1fedc
Instruction ID: ddf8a1217006fe99e567534e2ab14f1d5c65fab8da91782e6f372fabc1c9d6a4
Opcode Fuzzy Hash: 2fd1f05b101e8520a732a57a3fa589fd867a2ba9aefb81dc0cc5f72372d1fedc
Instruction Fuzzy Hash: 9AB217F360C204AFE304AF29EC8567AFBE9EF94720F16893DE6C583744E63558058697

Function 00AA1A1A Relevance: 11.6, Strings: 8, Instructions: 1587COMMON

Download Yara Rule

Strings

@y&, xrefs: 00AA2C46
,Kor, xrefs: 00AA24E5
0*}S, xrefs: 00AA29C1
Dy&, xrefs: 00AA2C41
[Ew, xrefs: 00AA2454
@D_, xrefs: 00AA21AC
WG>, xrefs: 00AA21D1
bFz, xrefs: 00AA257F

Memory Dump Source

Source File: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: ,Kor$0*}S$@D_$@y&$Dy&$WG>$[Ew$bFz
API String ID: 0-3359605569
Opcode ID: cd70777a639eecdc655dc9d23f1255895f19a1ac1a92544fdf56187fda258017
Instruction ID: a2d8060c0aebba3894aad1539f76b27ec8b8d052e95d8927d85353f80ead16cc
Opcode Fuzzy Hash: cd70777a639eecdc655dc9d23f1255895f19a1ac1a92544fdf56187fda258017
Instruction Fuzzy Hash: E7B239F3A0C204AFE3046E2DEC8567AB7E9EF94720F16493DEAC4D3744EA3558018697

Function 008F098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

qrqp, xrefs: 008F1089
,#15, xrefs: 008F0F94
gce/, xrefs: 008F1073
cah`, xrefs: 008F107E
{, xrefs: 008F1502
&> &, xrefs: 008F0F89
9.5^, xrefs: 008F0F9F
%*+(, xrefs: 008F0A77, 008F0A86

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: 735f1e38b224105fd0b9368664e62167d1d953eed9b004146c9fecba01e51583
Instruction ID: 7584dd75f393c2904ebc87c7db301c1aa21f62888189c5b147e0502d7048c436
Opcode Fuzzy Hash: 735f1e38b224105fd0b9368664e62167d1d953eed9b004146c9fecba01e51583
Instruction Fuzzy Hash: C762A8B16083858FD730CF28D895BABBBE1FF96314F04492DE59A8B642E7358941CB53

Function 008D1000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

0123456789ABCDEFXP, xrefs: 008D157D, 008D15EB
gfff, xrefs: 008D2297
gfff, xrefs: 008D22E1
-, xrefs: 008D21ED
@, xrefs: 008D2C40
0123456789abcdefxp, xrefs: 008D1587, 008D15F8
gfff, xrefs: 008D2226

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: f854c00f1d3ed182e0dee16941370c23d9c1543ac77af8924f292b6e5f0d2269
Instruction ID: 465d565d8535c12e9bb66e5ce8f7dd9785650ad99beeb8073c3720803579f219
Opcode Fuzzy Hash: f854c00f1d3ed182e0dee16941370c23d9c1543ac77af8924f292b6e5f0d2269
Instruction Fuzzy Hash: 4CD2BE716083519FDB18CE28C49436ABBE2FFD9314F188B2EE499CB391D674D945CB82

Function 00AAD6D6 Relevance: 10.4, Strings: 7, Instructions: 1605COMMON

Download Yara Rule

Strings

^?O, xrefs: 00AADC8A
{?, xrefs: 00AAE740
J[xE, xrefs: 00AAE4E6
@y, xrefs: 00AAE1BB
m@-_, xrefs: 00AAD845
^&~k, xrefs: 00AAE7C3
V9O, xrefs: 00AAE18B

Memory Dump Source

Source File: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: @y$J[xE$V9O$^&~k$^?O$m@-_${?
API String ID: 0-3358724681
Opcode ID: d2dce3b0ee9e372c637342a71992c1a9ce4ee1e38a9eaa411641978b1b020032
Instruction ID: e77c40b0e35c8ae77e5ad0d39cad9f7b3dd0c923c1fa34c3599709337834714c
Opcode Fuzzy Hash: d2dce3b0ee9e372c637342a71992c1a9ce4ee1e38a9eaa411641978b1b020032
Instruction Fuzzy Hash: A8B2E5F360C604AFE3046E29EC8567ABBE9EFD4320F16493DE6C4C7744EA3598418697

Function 00AABB72 Relevance: 9.2, Strings: 6, Instructions: 1698COMMON

Download Yara Rule

Strings

E5??, xrefs: 00AABFF7
w?S, xrefs: 00AABF42
?q,, xrefs: 00AAC690
N4], xrefs: 00AACE1E
q}/o, xrefs: 00AAC970
I[w, xrefs: 00AAC064

Memory Dump Source

Source File: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: ?q,$E5??$I[w$q}/o$w?S$N4]
API String ID: 0-2858938250
Opcode ID: 578629b5a0613a253a39f6b784d9555f421f4e7f00fd27516cb5735bc823f410
Instruction ID: ac65133ccc4d8d77a11961bc13a8031122630c3663d1b6ecbcce3f69a461bed8
Opcode Fuzzy Hash: 578629b5a0613a253a39f6b784d9555f421f4e7f00fd27516cb5735bc823f410
Instruction Fuzzy Hash: 5EB23BF360C2049FE704AE2DEC8567ABBE6EBD4320F16853DE6C5C7744E93598058692

Function 00AA5025 Relevance: 9.1, Strings: 6, Instructions: 1618COMMON

Download Yara Rule

Strings

A77, xrefs: 00AA5A63
EY(, xrefs: 00AA5F2B
2<c, xrefs: 00AA5656
L"{~, xrefs: 00AA5968
&Km, xrefs: 00AA5792
2<c, xrefs: 00AA5641

Memory Dump Source

Source File: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: &Km$2<c$2<c$A77$EY($L"{~
API String ID: 0-960411073
Opcode ID: 9e41231fe83421b54652e146b82fc758a468da5bbcd1f9d4a81c94396fe93e70
Instruction ID: cae34b259911d8b6e7b61b82425d57a706092a077c491edd41e9ac83e73bcd70
Opcode Fuzzy Hash: 9e41231fe83421b54652e146b82fc758a468da5bbcd1f9d4a81c94396fe93e70
Instruction Fuzzy Hash: A4B206F3A082109FE7046E2DDC8577ABBE9EF94720F1A893DEAC4C3744E93558058697

Function 00AA34C2 Relevance: 7.9, Strings: 5, Instructions: 1628COMMON

Download Yara Rule

Strings

RJeS, xrefs: 00AA3CCC
do, xrefs: 00AA4135
{=o, xrefs: 00AA3763
mKu7, xrefs: 00AA3BDD
mKu7, xrefs: 00AA3BCF

Memory Dump Source

Source File: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: RJeS$do$mKu7$mKu7${=o
API String ID: 0-1992337622
Opcode ID: 9a0bffc56f5ba00729b7e777ce3578b183e66ddc937d09f30b6fdaf4e5c1c34f
Instruction ID: 8c4d5598f49acfcdef7568041f58ad1a8643e460459b5084e353f155fe1b0c62
Opcode Fuzzy Hash: 9a0bffc56f5ba00729b7e777ce3578b183e66ddc937d09f30b6fdaf4e5c1c34f
Instruction Fuzzy Hash: 1BB208F360C3049FE3046E29EC8567AFBE9EF94720F1A853DE6C583744EA3598058697

Function 008D12F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

i, xrefs: 008D28EA
@, xrefs: 008D3531
0, xrefs: 008D243E
0, xrefs: 008D1DC1
0, xrefs: 008D1E88

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: d39fcce28d2c9cb8efabe9b9546ae4a0f95b3eb5644dd927ceb1e36a9b0eab36
Instruction ID: 5a9be42d0d478621bed3aef7eca36dd0c15e5519936944c9c9c5a114cdc96ceb
Opcode Fuzzy Hash: d39fcce28d2c9cb8efabe9b9546ae4a0f95b3eb5644dd927ceb1e36a9b0eab36
Instruction Fuzzy Hash: 9462D07160C3819BC718CE28C49476ABBE1FFA5318F188A6EE8D9C7391D774D945CB82

Function 008D164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

0123456789ABCDEFXP, xrefs: 008D164F
+, xrefs: 008D1573
gfff, xrefs: 008D1F57
gfff, xrefs: 008D1F3C
0123456789abcdefxp, xrefs: 008D1659

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: d045e6453488306a7823706ce73f318b4e7066dbd5bd7771e28fe0d7b1518dd1
Instruction ID: 0390d69905d8fff11f02f2f48e5a13968e6b045ad366c5e1cbc67a073abfd646
Opcode Fuzzy Hash: d045e6453488306a7823706ce73f318b4e7066dbd5bd7771e28fe0d7b1518dd1
Instruction Fuzzy Hash: 8DF19F3160C7818FC719CE28C48426AFBE2BFE9304F188A6EE4D9C7356D674D945CB92

Function 008D13A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

0123456789ABCDEFXP, xrefs: 008D13A3
gfff, xrefs: 008D1F57
gfff, xrefs: 008D1F3C
0123456789abcdefxp, xrefs: 008D13AD
-, xrefs: 008D1F23

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 8821c2a42782901541399a909d3661d843b060917cd560365a2d7fd81574cc5a
Instruction ID: 8bb7cb2fbfac4a2f9c1c6722e0671be86459dbbf47a00990fb6395719a7f6f86
Opcode Fuzzy Hash: 8821c2a42782901541399a909d3661d843b060917cd560365a2d7fd81574cc5a
Instruction Fuzzy Hash: 0DD17D316087819FC719CE29C48466AFBE2AFD9308F08CA6EE4D9C7356D634D949CB52

Function 00AAF0FE Relevance: 6.5, Strings: 4, Instructions: 1549COMMON

Download Yara Rule

Strings

O]t, xrefs: 00AAFEF5
P>, xrefs: 00AB01FF
ox|}, xrefs: 00AB0455
$LS|, xrefs: 00AB0043

Memory Dump Source

Source File: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: $LS|$O]t$P>$ox|}
API String ID: 0-1373829210
Opcode ID: a38a6bd3d484959c85099e80107913f641cb69f5391fa85523f5f0d67fb9921f
Instruction ID: 6d01a0b799b327cbaf8b43bedd0855d47ba1face014609d67b1fe0b22a5d5db6
Opcode Fuzzy Hash: a38a6bd3d484959c85099e80107913f641cb69f5391fa85523f5f0d67fb9921f
Instruction Fuzzy Hash: F9B2F5F39086009FE304AF29EC8567AFBE5EF94720F1A493DEAC483744E63558458797

Function 008FFD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

uvw, xrefs: 008FFE95
:, xrefs: 00900087
m1s3, xrefs: 008FFEC3, 008FFECB
NA_I, xrefs: 0090036D

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 08fd5e810c216715ee92ffd8085762db634e04adf35b21cbb2a715286a226d93
Instruction ID: 9b9500775d086852dded1c2e1c683a4499bc5cebf7882a314ba4ae5f1d01a0f8
Opcode Fuzzy Hash: 08fd5e810c216715ee92ffd8085762db634e04adf35b21cbb2a715286a226d93
Instruction Fuzzy Hash: 8232A6B051C381DFD311DF29D880B2ABBE5BB9A340F144A2CF5D58B2A2D335D956CB92

Function 00A9ABE2 Relevance: 5.5, Strings: 3, Instructions: 1727COMMON

Download Yara Rule

Strings

^WX, xrefs: 00A9BBC8
C?, xrefs: 00A9B4E5
u->=, xrefs: 00A9AED5

Memory Dump Source

Source File: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: u->=$C?$^WX
API String ID: 0-2156647959
Opcode ID: 7091f7e5e47f2e0a030f73f16cccecb9db1ecdcf388cf06ab88e4f841e236f5d
Instruction ID: b3b1c2273055341d46f3da5e5bf4873987cdad520e0067e1a4277589d0205126
Opcode Fuzzy Hash: 7091f7e5e47f2e0a030f73f16cccecb9db1ecdcf388cf06ab88e4f841e236f5d
Instruction Fuzzy Hash: 52B24AF360C204AFE3046E2DEC8567BFBE9EB94720F1A463DEAC5C3744E93558058696

Function 008E3BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

%*+(, xrefs: 008E3EC4
p, xrefs: 008E3C80
ss, xrefs: 008E3C79
;z, xrefs: 008E3C87

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: d0aab9dae2b2bab10001b80349b1cd274ec911730288dbac1499a3ab628f6707
Instruction ID: bcf86b55c03279059007af5b5acfdb6a5f56882dac5710663974f64c4e3b520c
Opcode Fuzzy Hash: d0aab9dae2b2bab10001b80349b1cd274ec911730288dbac1499a3ab628f6707
Instruction Fuzzy Hash: 5B025CB4810B40EFD760DF29D986756BFF5FB02300F50895DE89A9B656D330E819CBA2

Function 008F2260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

sj, xrefs: 008F2327
hu, xrefs: 008F232F
a|, xrefs: 008F2317
lc, xrefs: 008F2507

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: add450f5df2f2af1e0a05ed84086fd34eb2a6d1bedfb8c2709045bf0b08cf3ff
Instruction ID: 50d103310823b0bc37c578dc593b6179b39207530d1466bbc76cfe8bb793f2de
Opcode Fuzzy Hash: add450f5df2f2af1e0a05ed84086fd34eb2a6d1bedfb8c2709045bf0b08cf3ff
Instruction Fuzzy Hash: 4BA189B04083458BC720DF28C891A3BB7F0FFA5354F548A0CE9D59B2A1E379D945CBA6

Function 008FD7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

#', xrefs: 008FD9EA
T>, xrefs: 008FD984
CV, xrefs: 008FD98B
KV, xrefs: 008FD97D

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: 7fdb246f174c00929a6a3d06d8a8baf92ff35df78b29b5425e23a0c06d4ae106
Instruction ID: 4898f4b133316b3521dd09236ea9fb59dd9ef36dca2172c1d8da34c95fb11f51
Opcode Fuzzy Hash: 7fdb246f174c00929a6a3d06d8a8baf92ff35df78b29b5425e23a0c06d4ae106
Instruction Fuzzy Hash: AD8148B48017499FDB20DFA5D28516EBFB1FF12300F605A0CE586ABA55C370AA55CFE2

Function 008FAC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

,{*y, xrefs: 008FAD07, 008FAD13
lk, xrefs: 008FACBC
(g6e, xrefs: 008FACA1
4c2a, xrefs: 008FACA9

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: edb9a9ea48028a707124f9e8b3e8971b905f49f0fbe478bdd80c0bce44cbad3a
Instruction ID: 5a29efe5fc7a521cdd3c162b7481e4191252e44c8c4a35a30e84c49e7ed31be0
Opcode Fuzzy Hash: edb9a9ea48028a707124f9e8b3e8971b905f49f0fbe478bdd80c0bce44cbad3a
Instruction Fuzzy Hash: E64186B4418385CBD7209F20D900BABB7F4FF86305F54995DE6C897260EB32D945CB9A

Function 008FC470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 008FC8C3, 008FC8CB
~/i!, xrefs: 008FC537
%*+(, xrefs: 008FC9E4, 008FC9ED

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: 46fb54fef63ae83f8f9807385d8c69b2fa6b4bc01f314f2b4122524a658a85f3
Instruction ID: 6da4fc23de5020d8a0d33b9eabbad2246e5ff6bb0f8a8faa29ae0d34e04a2d22
Opcode Fuzzy Hash: 46fb54fef63ae83f8f9807385d8c69b2fa6b4bc01f314f2b4122524a658a85f3
Instruction Fuzzy Hash: 74E197B552C348DFE3209F24D881B6EBBE5FB95344F48882CE6C987251D731D925CB92

Function 00AA6AE1 Relevance: 4.1, Strings: 2, Instructions: 1615COMMON

Download Yara Rule

Strings

4{], xrefs: 00AA72F1
Tt~s, xrefs: 00AA7461

Memory Dump Source

Source File: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: 4{]$Tt~s
API String ID: 0-3172003110
Opcode ID: 07d43d977a3957c9418e1a5c724fc6ec66cba246420e57a747bf248d85e3bba4
Instruction ID: 0db8d9b7ef8ed392b6aee1b7a8ec48a8cd6d3bd45948827a5eff9bf13d4dd263
Opcode Fuzzy Hash: 07d43d977a3957c9418e1a5c724fc6ec66cba246420e57a747bf248d85e3bba4
Instruction Fuzzy Hash: 97B217F360C2149FE3046E2DEC8567AFBE9EF94320F164A3DEAC5C3744EA3558058696

Function 00914040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 0091420C
%*+(, xrefs: 009140A4, 009140AD

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 1a9955a336236686ed2ebcdbfb42c889f36993c836c515c297a6fcb820f51ed6
Instruction ID: cc5bcc39fbd496067d7e8d16a0a4aca15202af3bfe38e81dbfd0af537ca63074
Opcode Fuzzy Hash: 1a9955a336236686ed2ebcdbfb42c889f36993c836c515c297a6fcb820f51ed6
Instruction Fuzzy Hash: 0912AC716083459FC715CF18C880B6EBBEAFBD9314F588A2CF4A48B291D735D985CB92

Function 0090F620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

hi, xrefs: 0090F6E6
dg, xrefs: 0090F7F5

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: bd68ea952dfd3fa989c66f8448043b498f5743e937539d1e5053dd1c331513da
Instruction ID: be83bc4e99704262c6542e280feb4e9d27a574904322b3d0656842ef546d28fb
Opcode Fuzzy Hash: bd68ea952dfd3fa989c66f8448043b498f5743e937539d1e5053dd1c331513da
Instruction Fuzzy Hash: 00F1A671618302EFE324CF24D8A1B6ABBF6FB85344F14892CF5958B2A1C734D945CB52

Function 008D35B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

Inf, xrefs: 008D3607
NaN, xrefs: 008D360E

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: cee29d2927e84f7abf66e2fff5ac0fc3bbf0a02b1316e82c5a57aeae268f82b5
Instruction ID: dfd73d5efa9c5d27318b3fd7b68829c436d5e10456a57dd2e6ae2374421ae33f
Opcode Fuzzy Hash: cee29d2927e84f7abf66e2fff5ac0fc3bbf0a02b1316e82c5a57aeae268f82b5
Instruction Fuzzy Hash: 50D1B3B1B187119BC704CF28C88061ABBE5FBC8750F158A3EF999D73A0E675DD059B82

Function 008EFFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 008F0197
Ye[g, xrefs: 008F00F6

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: 434983cc403439586175a4bff84c89d16a4549a0ab45e34d6cd79a69b137e1ba
Instruction ID: f875018192ed5e0a7162f531c85d375024eadaeb1284ca567e390aaffc6cea1c
Opcode Fuzzy Hash: 434983cc403439586175a4bff84c89d16a4549a0ab45e34d6cd79a69b137e1ba
Instruction Fuzzy Hash: 545189B16083898ED7318F28C881BBBB7E0FF96310F19491DE499CB652E7749940CB57

Function 008D5160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 008D54C8

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 33bf504d4d6f50ded0603232b6cc63a9eb40df068fdd06eaea52c657b8d46bbe
Instruction ID: deedb1df4ee9df302d809ca2a35fb4c42809a19fd8763ff9da430727d57759e0
Opcode Fuzzy Hash: 33bf504d4d6f50ded0603232b6cc63a9eb40df068fdd06eaea52c657b8d46bbe
Instruction Fuzzy Hash: 6C22B1B6A08B468BE7158E18D540727BBA2FFA1318F29876FD859CB341E771DC05C742

Function 009012D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 009015D1

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 2c6cb560a4b94e41d4f2c2091a7d01109f7c5d56f9e2474df546654f984757c1
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: DEF1F371A083514FC724CE28889076BBBEAAFC5354F18C96DF89A8B3D2D634DD45C792

Function 008FAE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 008FB2D3, 008FB2DB

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: b7d8242570026b28d0556c0e96110302556758dbbddbe53869ecb9a08118b192
Instruction ID: 1cd8d4cd77e14cb7c5ab39721e9bd49c9f299a0c0aa9806db1762fee818c1af6
Opcode Fuzzy Hash: b7d8242570026b28d0556c0e96110302556758dbbddbe53869ecb9a08118b192
Instruction Fuzzy Hash: 73E1BB7150830ACBC324DF28C89056EB7E2FF98791F55891CE6C5C7220E731E9A5DB92

Function 008E6EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 008E6EF3

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: cb4688a0a5bfa9588a8e860c9558551a802c80a92ab8631470790d735248190d
Instruction ID: b65e4da7ffbec5e21dc3f87870ad3360cd262ccc6d7a3fbf86d42635a2043945
Opcode Fuzzy Hash: cb4688a0a5bfa9588a8e860c9558551a802c80a92ab8631470790d735248190d
Instruction Fuzzy Hash: EDF1BDB5A10A46CFC7249F29D891A26B3F2FF99354B148A2DD497C7691FB30F821CB41

Function 008F7E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 008F8263, 008F826B

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 9ae260521f4ae759684e3c559439a110a607e96de67dd0f257e80e408fbed130
Instruction ID: 8cbc422ff1318ba3944aaf6af78a8b02679b09fcdcb67f56ee51c48d4ecfcc37
Opcode Fuzzy Hash: 9ae260521f4ae759684e3c559439a110a607e96de67dd0f257e80e408fbed130
Instruction Fuzzy Hash: AEC1BD71508208EBDB10AB28C882A3BB7F5FF91754F584918FAC5C7251EB34EC51CBA2

Function 008F8D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 008F9233, 008F923B

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 3ee160b1c640b87e4b2d1b6aa5c1498d7f841e1569d7fc947f1766c3800047e4
Instruction ID: f3c30ff5672d6a1a445914bcceacbcdbd67076d6749d946f976b79b2bb37c441
Opcode Fuzzy Hash: 3ee160b1c640b87e4b2d1b6aa5c1498d7f841e1569d7fc947f1766c3800047e4
Instruction Fuzzy Hash: 09D1DC70629306DFD714DF68D880A2AB7E5FFC8304F49886CE986C72A2DB30E851DB51

Function 00917FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00918167

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 3c56e7e92cb5fb19b62e511e6ebded599a46e37fab68c75d393cc697186c2d98
Instruction ID: 58eb03d325293eba741d83abeae48f10149983b1105337bb776bc0e95e7d5370
Opcode Fuzzy Hash: 3c56e7e92cb5fb19b62e511e6ebded599a46e37fab68c75d393cc697186c2d98
Instruction Fuzzy Hash: 21D12632A083694FC725CE18949079FB7E1EB85758F158A2CE8B5AB390CB71DC86D7C1

Function 008FCCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 008FCDC3, 008FCDCB

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: a8f1cf0646af246662d6829c0073421777b6a904c1eff3140f1f5b36fd87018e
Instruction ID: 6ad4f36bff01a79ce64f04d3292e95283aab8d07139e2147810ba9fece4a2512
Opcode Fuzzy Hash: a8f1cf0646af246662d6829c0073421777b6a904c1eff3140f1f5b36fd87018e
Instruction Fuzzy Hash: B0B1CC7060930D9BD714EF28D980A3BBBE2FF85344F14492CE685CB251E735EA55CBA2

Function 0090FC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0090FCA4, 0090FCAD

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 4e7ca7e1cc779e6632cf30256e9636c6cf8dc80f25a1348450698c29b583061b
Instruction ID: 85f14d396a8dd42d2003595e265d4ef7191e51e8a248bd67a1caa168fe03d43e
Opcode Fuzzy Hash: 4e7ca7e1cc779e6632cf30256e9636c6cf8dc80f25a1348450698c29b583061b
Instruction Fuzzy Hash: B481CA70218305EFD720EF68D991B2AB7E9FB99701F04882CF18487291D730EA55DB62

Function 008ED457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 008ED663, 008ED66B

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 3c5815e9f05777b8f2e9a39894d6151d255e1facbf181ed51d41580c99730a2f
Instruction ID: b135f46b5a915568c6938cd212a67ceba0b05098dff0cbe55a256df2d8b43507
Opcode Fuzzy Hash: 3c5815e9f05777b8f2e9a39894d6151d255e1facbf181ed51d41580c99730a2f
Instruction Fuzzy Hash: C561E1B1908355DBD720EF19DC82A2AB3B1FF96354F080929F985CB362E331D915C792

Function 00A4886B Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

KK9w, xrefs: 00A489BE

Memory Dump Source

Source File: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: KK9w
API String ID: 0-3514501924
Opcode ID: 75170a467ee735443822550d20c440f5175f46108ee6b32032025a1fa67e7e5b
Instruction ID: b5a50260abf452262f80dfd37362b45ead55d21f16ea7aa043343f5416d06e06
Opcode Fuzzy Hash: 75170a467ee735443822550d20c440f5175f46108ee6b32032025a1fa67e7e5b
Instruction Fuzzy Hash: 196148F3E182205FE7145A2DEC8576AB7D5DBC4320F2B063EEA88D7780D97A5C058296

Function 00914A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00914C33, 00914C3B

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: bd09b3069463ab89e94e221da109a126eae4cf757235d87d4b1425ba63a1876c
Instruction ID: e2fcbca7f46a860f803a299c5eba5e3d4f15187c18e7c8c0ef8019f522577c13
Opcode Fuzzy Hash: bd09b3069463ab89e94e221da109a126eae4cf757235d87d4b1425ba63a1876c
Instruction Fuzzy Hash: B961DE7574D3099BD710DF15C880BAEB7EAEBC8310F29892CE5C487291D631EC91CB92

Function 00B31DF5 Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

!ir, xrefs: 00B31FF1

Memory Dump Source

Source File: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: !ir
API String ID: 0-1181633194
Opcode ID: 053016901c90805f54df56dc63a9f442911eea6fd663e986bd48aba4ee98053d
Instruction ID: 1248d32ec2bb3b250a0e97ce753b5820bddbad5534692dc52cb801d819df90a7
Opcode Fuzzy Hash: 053016901c90805f54df56dc63a9f442911eea6fd663e986bd48aba4ee98053d
Instruction Fuzzy Hash: AC718EB250C604EFE305BF28D88167AF7E9EF94710F268D2CEAC587704E63599509B47

Function 008DE1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 008DE333

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 205cff1f183ce6988085b96774820ce52aed76ff42b744d0df3d7a52814ce747
Instruction ID: b0d08c20cbb3b8010f1cf006dc4c1aa24a39e2bc39f52ed59e58a4efb98a80ac
Opcode Fuzzy Hash: 205cff1f183ce6988085b96774820ce52aed76ff42b744d0df3d7a52814ce747
Instruction Fuzzy Hash: D0513723B5D6904BD328A93C5C912A97B875B92338B3DC36AF9F1CF3E4D55548009390

Function 00A5AAB3 Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

_Vw, xrefs: 00A5AAD7

Memory Dump Source

Source File: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: _Vw
API String ID: 0-610139587
Opcode ID: 498ef27b05aadda84023188b44614ef63e32c6af921a012769db3b45b0722602
Instruction ID: 0cfff9025cae21a215657e513a3d72fe071f6fe4f3c2146926d220335b3475d8
Opcode Fuzzy Hash: 498ef27b05aadda84023188b44614ef63e32c6af921a012769db3b45b0722602
Instruction Fuzzy Hash: FA5108F3A182005FE3009A29EC8576BB7D7EBD4320F2AC63DE68487788E93598058656

Function 00913920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009139E3, 009139EB

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: a3f572fb390ed3d2dde237963338522ca3349269a3d6739b127d8c61858ec77c
Instruction ID: 4ccede4e53c2c4fa3fa8a2a4c51ddea3fcafa08e31f003f13e5c2c6976647d8f
Opcode Fuzzy Hash: a3f572fb390ed3d2dde237963338522ca3349269a3d6739b127d8c61858ec77c
Instruction Fuzzy Hash: 7B517934719248DBDB249F19D880A6ABBF9EF85744F18C82CE4C687251D371DE90DB62

Function 008E1BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 008E1C3E

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: 61abdb9544cd9b7cbdcc220d2197f90fb72be928a007c652cdb79c70529975a1
Instruction ID: 221bee6c6000cbe8dc2150fb63245fa862b8e298ff175990e5c4cf9c4815f9f5
Opcode Fuzzy Hash: 61abdb9544cd9b7cbdcc220d2197f90fb72be928a007c652cdb79c70529975a1
Instruction Fuzzy Hash: 39414DB41183849BCB149F29D898A2EBBF0FF8A314F14891CF5D5DB290D736CA058B56

Function 0090FF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00910033, 0091003B

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 9b88aced182109275a51179c91b33bb407102d276a16c599b6fa4a3ea42c9a38
Instruction ID: e3df61734025f601d3f359f18a98879c71bc9ab54b277b90e134d041bfa966d2
Opcode Fuzzy Hash: 9b88aced182109275a51179c91b33bb407102d276a16c599b6fa4a3ea42c9a38
Instruction Fuzzy Hash: 6431F8B5B08319ABD610EA14DC41B6BB7EDEBC9744F544828F884D7252E272DCD4C763

Function 008FE40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 008FE6A2

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 58b4c6e0308ec9ac866d5accc3e5b607c6124773864881e8eee5b1ba2335aeff
Instruction ID: d17722df3de9ca8ac6469a8ce79c96527659460a9b4788a189ecd9a70f0d346e
Opcode Fuzzy Hash: 58b4c6e0308ec9ac866d5accc3e5b607c6124773864881e8eee5b1ba2335aeff
Instruction Fuzzy Hash: 9F3104B5905219CFCB20DFA9E8805BFBBB5FB1A344F140429E546E7311D331A941CBA2

Function 008E6F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 008E703B

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c667637fae19a7a1509e1ee292e0ee5a32fffd362f3ec6e0c9bac69a2794dd24
Instruction ID: 18d14fe51dfbf2743dba22e86661115309e84160cbfd7b822c5f376e0742ae79
Opcode Fuzzy Hash: c667637fae19a7a1509e1ee292e0ee5a32fffd362f3ec6e0c9bac69a2794dd24
Instruction Fuzzy Hash: B9416771219B44DBD7348F62D990B27B7F2FB4A700F14881CE5869BAA1E331F810DB10

Function 008FE66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 008FE6A2

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 3c76c5f2f29f92ccd13059b69f29f08c011a98f76ac0ad0affbb73b4a8282c64
Instruction ID: f23803fdbc272877d1ca4a7b56bde9fa5730f68363861516189e8a210b40db53
Opcode Fuzzy Hash: 3c76c5f2f29f92ccd13059b69f29f08c011a98f76ac0ad0affbb73b4a8282c64
Instruction Fuzzy Hash: 3F21BFB5905209CFC720DFA5E88057FBBB5FB2A744F140818E546EB351D335A941CBA2

Function 00919CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00919D30

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: cb744046126eb69c623f5e35967a827035b86127390625921dc212d628813d31
Instruction ID: 714004b3e3d0478afc161b55299ca3ec850604bbf00706dc69a07a63a4d35d2b
Opcode Fuzzy Hash: cb744046126eb69c623f5e35967a827035b86127390625921dc212d628813d31
Instruction Fuzzy Hash: 163198746093048BD310DF14E890A6AFBF9FF8A314F14892CF1C897291D335D844CBA6

Function 008E4E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8103f01557ac67c4c3053698f6708f011e1c25a1f7f049716dbb84a41a6e17f5
Instruction ID: 969241cbaa626955dafbb046f0992b6ae9c38bdf8dc36ce3bbdd40b00d4cd64c
Opcode Fuzzy Hash: 8103f01557ac67c4c3053698f6708f011e1c25a1f7f049716dbb84a41a6e17f5
Instruction Fuzzy Hash: E86247B4600B808BD725CF29D990B27B7F6FF56704F54892DD49ACBA92E770E804CB91

Function 008DBEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: d484dd9385d4231d51101cc1a7bbf7066ea6bf1f1b576a4db813cd494167a384
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: 5752C5319087168BC7259F18D4402BAB3E1FFD5319F298B2ED9D6D7390EB34A851CB86

Function 00918652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eef3d40f672b2b961bf88342f4d616a132cb79679d93dd905a9ebee425c51ff
Instruction ID: 6264d633a1c63b253283446fc064785c75cff5dfb8905ffc11f6c0cf0b46b5da
Opcode Fuzzy Hash: 3eef3d40f672b2b961bf88342f4d616a132cb79679d93dd905a9ebee425c51ff
Instruction Fuzzy Hash: 7C22EA3561C345CFC714DF28E89062ABBE1FF9A315F09886DE48987352C735E8A1DB82

Function 009186F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45725ba22bcaced07ce2b1a7964c73509677003dc8074002126a21a6be104c9f
Instruction ID: b43395aa6e4dd7337cd2d736af3030022a847147b7c0880e0c7f237077d7a29e
Opcode Fuzzy Hash: 45725ba22bcaced07ce2b1a7964c73509677003dc8074002126a21a6be104c9f
Instruction Fuzzy Hash: C822B93561C344DFC714DF68E89062ABBF1FB9A315F09896DE48987352C335E8A1DB82

Function 008DB3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e893f55e1cbeb2f8ab58e3cc658f64add8e336da3349ef4c530553bbd3781ce7
Instruction ID: 9e5ddb8625eed7167716bf80f2b57b769d15cf6f17b035649126b935f4e3233b
Opcode Fuzzy Hash: e893f55e1cbeb2f8ab58e3cc658f64add8e336da3349ef4c530553bbd3781ce7
Instruction Fuzzy Hash: 9752A470908B88CFE735CB24C4847A7BBE2FB91314F164A2FC5D686B82C779A885C755

Function 008D71F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c4afb83886377689c0a71dbf70e5e9918c11cadd808b25dfd1cfb19198a2c48
Instruction ID: 5f767f05f2289640a5c82a1cf573e00f9e4e67548bcc8935bfdb823928e0f44c
Opcode Fuzzy Hash: 5c4afb83886377689c0a71dbf70e5e9918c11cadd808b25dfd1cfb19198a2c48
Instruction Fuzzy Hash: 3A52B23150C3498FCB15CF29C0906AABBE1FF88318F598A6EF89997351E774D949CB81

Function 008D8FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7184a578f4f792dfcb356559f6d938b33c807d4e389218e28680655bc6389e11
Instruction ID: 96abd996395c654a70b05856570c868d207b851a9af1bde140441200f3b321eb
Opcode Fuzzy Hash: 7184a578f4f792dfcb356559f6d938b33c807d4e389218e28680655bc6389e11
Instruction Fuzzy Hash: B6427375618301DFD708CF28D8507AABBE1FB88314F09896DE8958B3A1D735D985DB82

Function 008D7BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6008ebd36ff62f7f820bea48236470a14996d42cd3fd55f2e00f44021cee22b
Instruction ID: fd556854d0f9f8828c2f8d93a2c687810efd561b67dd422902ddd3287cc74cf3
Opcode Fuzzy Hash: c6008ebd36ff62f7f820bea48236470a14996d42cd3fd55f2e00f44021cee22b
Instruction Fuzzy Hash: 5832EF70518B158FC378CF29C59056ABBF2FF45710BA44A2ED6A787B90EB36B845CB10

Function 009189A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc30bb685d4c66392cc33ebdeaeadd73c8994e9bba8ac33dd8615fd537dba37
Instruction ID: c1bf2ba666e7761a698ddd8626d2b69559c061d527d4be69003583890b44fd41
Opcode Fuzzy Hash: 5fc30bb685d4c66392cc33ebdeaeadd73c8994e9bba8ac33dd8615fd537dba37
Instruction Fuzzy Hash: 8F02B83461C245DFC714DF28E890A2ABBE5EF8A315F09896DE4D987361C336D851DB82

Function 00918A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 481aa084dc7b9be93c3ee9e0c9ecb1b3e2db9284d7e949852bd9afdfee532114
Instruction ID: 311325742113956924559ea68b26241672ea48deb40bac994c8217080c974726
Opcode Fuzzy Hash: 481aa084dc7b9be93c3ee9e0c9ecb1b3e2db9284d7e949852bd9afdfee532114
Instruction Fuzzy Hash: CCF1A73461C385DFC714EF28E89062AFBE5AF8A315F098D2DE4D987261C336D951CB92

Function 00918C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3b800c05c8abbf1466ee55805db9f5795ed8ac4eabb17c1f5b7e42b0c16943
Instruction ID: cfdd52e24867da27abcdabe043e3b1dd28d99b324170b1de928721162a444135
Opcode Fuzzy Hash: 3e3b800c05c8abbf1466ee55805db9f5795ed8ac4eabb17c1f5b7e42b0c16943
Instruction Fuzzy Hash: C0E1CA3171C241CFC714DF28E89066AFBE6EB8A315F09896CE4D987361D336E951CB82

Function 008DA300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 6e1a95c26f38e18bcd5281ff7dcc37fc71e88cf53e3dfb6c1ef1115d58efeee1
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: 9CF1AB766083458FC728CF29C88166ABBE2FFD8300F18892EE4D5C7751E639E945CB52

Function 00918E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e9ccfe804118a60f711168903901da83057f5b244781f43281a76a4e1d337b
Instruction ID: 1fb776188a91f5d7f640556a49b2a7e2c78ea0a0b803f1f98f09da6ab1254277
Opcode Fuzzy Hash: 90e9ccfe804118a60f711168903901da83057f5b244781f43281a76a4e1d337b
Instruction Fuzzy Hash: 1FD1B73461C284DFD704EF28E890A2AFBF5EB8A315F09896CE4D987251C336D851DB92

Function 008E4487 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f0bfb1a0d976767981345ac2fea6d97f754f2cc2427a83759ed8d29a7a71a6
Instruction ID: 80b35a535db4bf5e7f107c3ec95e3a80aa5dbe9a7657f922f64e6a3e9cfd3b66
Opcode Fuzzy Hash: d6f0bfb1a0d976767981345ac2fea6d97f754f2cc2427a83759ed8d29a7a71a6
Instruction Fuzzy Hash: 4AE1F0B5615B408FD321CF28D9A2B97B7E1FF06704F04886DE4AAC7762D735A814CB54

Function 00916CBF Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996fdfc27116a52e2a970b6ffee97490f9e4b22218a562579ab75c0027f9e5be
Instruction ID: 25e949de1e3a0f710b52172926a7d0fb0f93f7078149aa176d11d3f38c5c72e5
Opcode Fuzzy Hash: 996fdfc27116a52e2a970b6ffee97490f9e4b22218a562579ab75c0027f9e5be
Instruction Fuzzy Hash: E8D10236A2C355CFC720CF38D88056AB7E6BB89314F098A6CE891C7391D334DA46DB91

Function 00917AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5eddde3f5a840d054e08581e43260186b6a17fa4a35c9c4dd3bcc0c00eb7c61
Instruction ID: 7f047998511ccfb4a9c650c0fd54f6a639351bf6ee06a34f5fc051b190fe6e9e
Opcode Fuzzy Hash: c5eddde3f5a840d054e08581e43260186b6a17fa4a35c9c4dd3bcc0c00eb7c61
Instruction Fuzzy Hash: 8DB11472B0C35A4BE314DAA8CC417ABF7FAABC4314F08092DF99997391E635DC448792

Function 008DAF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 71c421b79c4f3d4762b83ff0f341b4b04cd10f619f3541b44147393f804dfe22
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: 3CC14A72A08741CFC360CF68DC96BABB7E1FB85318F094A2DD199C6342E778A155CB46

Function 008E6536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f6271c767b742b3c7fed4fac3891a83975f2cedcaccf8ae876bba90b07cf3e1
Instruction ID: b8f461dd82e806a764c17023dac3e2f6cbceffb64fa12c0f2ac8f88d6780d3fe
Opcode Fuzzy Hash: 1f6271c767b742b3c7fed4fac3891a83975f2cedcaccf8ae876bba90b07cf3e1
Instruction Fuzzy Hash: E4B111B4600B408BC3258F29C980B27BBF1FF56704F14895DE8AA8BB52E335F815CB55

Function 00917710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4ee9b28b29569ca794092d7068555745b823c98091f027e63767887878f52876
Instruction ID: c14bb78e55930fcee77d257f830563ff7d1588e86cd1274003c63a4a67d2ad8f
Opcode Fuzzy Hash: 4ee9b28b29569ca794092d7068555745b823c98091f027e63767887878f52876
Instruction Fuzzy Hash: 65917C7170C306ABE720DA94C880BABF7FAEB85350F54881CF59597391E730E984DB92

Function 0091A0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5d39e0daba79dc1abc1d0a5f7bba337cd3f0ef6a0d0455784c192fed07c2fd
Instruction ID: c3ddbb4ef94cbe0db1ef7398c077105729777242dca50d3845abc8dfc288698f
Opcode Fuzzy Hash: bb5d39e0daba79dc1abc1d0a5f7bba337cd3f0ef6a0d0455784c192fed07c2fd
Instruction Fuzzy Hash: BA81AF3430A3099FD724DF28C880A6AB7F9EF89750F45892CE495C7251E731EC91CB92

Function 009064F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5884e9b1ff1bce831962e80558a6e5da865391b071ac695388c396cddc4be95e
Instruction ID: f86d15fc007fd6eb0c72882399c421372f565ef308b317719f53b380eeed7f38
Opcode Fuzzy Hash: 5884e9b1ff1bce831962e80558a6e5da865391b071ac695388c396cddc4be95e
Instruction Fuzzy Hash: A871F433B69A904FD3148D7C4C82395AA834BD7334F3EC779A9B4CB3E5D62A48169380

Function 008F28E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7f2ed1966cfd647b36ef323c80a67e7700296a7b8176c7d2fcdf31a5478544
Instruction ID: fd09d8133a0b7fc155908db998e730094a8f3caa24b17dae665194adda04ec6e
Opcode Fuzzy Hash: ad7f2ed1966cfd647b36ef323c80a67e7700296a7b8176c7d2fcdf31a5478544
Instruction Fuzzy Hash: 866175B44183548BD310AF29E841A2BBBF1FFA6754F08491DE6C58B362E339D911CB67

Function 008F7C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d3ec639715ae07e73186449e2d8deac306b313f9eea1cc482e46ce0187efac1
Instruction ID: 2795baedb8e80dfad6c41c0784e0f7bb3b19e696508536936bbe6a9c80950d56
Opcode Fuzzy Hash: 9d3ec639715ae07e73186449e2d8deac306b313f9eea1cc482e46ce0187efac1
Instruction Fuzzy Hash: C4519CB1648219ABEB20AB34CC92BB733B4FF85758F144558FA85CB291F375D805C762

Function 00A3BFA5 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31eaec70797d756555829c3b09d107689e3af7bc7b1457fd4be67715a2109a4
Instruction ID: e764617fbc4526102d76bbac8c58ef2ace26ca8b65a15924eb5cd6d35efbf000
Opcode Fuzzy Hash: c31eaec70797d756555829c3b09d107689e3af7bc7b1457fd4be67715a2109a4
Instruction Fuzzy Hash: B76169F36187045BE304AA3DEC847AAB7DAEFD4720F1AC53D97C0C7784E97898058696

Function 0093E450 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97e55bbf744935986196ac5e6f2e1a1b38240fdf5ac692b3247fc9a9484dfff2
Instruction ID: 89accb2567366c6bcacbd9d03a9b3b18c26ff026110738ccd2c9ac942812e577
Opcode Fuzzy Hash: 97e55bbf744935986196ac5e6f2e1a1b38240fdf5ac692b3247fc9a9484dfff2
Instruction Fuzzy Hash: 9B71D7F39086005FF3446E29DC8537ABBE6EFD4720F27853DD5C983B84D93848458686

Function 00901860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: aa0684a5d59389981a6557d5b4fde1fea85f3e20be76c95b0e1c245e9d3e8cc0
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 0861BD31709302AFD714CE68D58072FBBEAABC5350F68C92DF4998B391D274DD859B42

Function 009082D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c56d87c1e135837dc9e84be99621109866148ab3fe168c9b103141a2e080e8
Instruction ID: 88ef116aaa88d0ae6e2758c179d435f746292cfad2a914deb861af14aa6e9b69
Opcode Fuzzy Hash: 74c56d87c1e135837dc9e84be99621109866148ab3fe168c9b103141a2e080e8
Instruction Fuzzy Hash: A7610523B5EAA14FD314453C5C563ABAA871BD2730F3EC7A6A9F18B3F5C96D48019341

Function 008E42FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8199fd6c26a56028865f1bc032260402f53408a5b01501c6a4a5fff6d64619
Instruction ID: 449f3ca488947dd68d6765478b1dbdc45200816b2466c2b94049e6912e203d3b
Opcode Fuzzy Hash: af8199fd6c26a56028865f1bc032260402f53408a5b01501c6a4a5fff6d64619
Instruction Fuzzy Hash: 7A81CEB4810B40AFD360AF39D947797BEF4FB06201F504A1DE4EA96695E7306419CBE3

Function 009B2568 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d313fc1888010efef6e42c984cf526a439d7372d2cc7b4f7a7f0a77b46e2ab
Instruction ID: c9ee977aa00a876458d1ba9f4069e807e20bccfd8e64d133376a4209c533464d
Opcode Fuzzy Hash: d9d313fc1888010efef6e42c984cf526a439d7372d2cc7b4f7a7f0a77b46e2ab
Instruction Fuzzy Hash: 5F5155F7B482005BF344996DEC8076BB2DADBD4660F2EC63DE584C7B08E579DC0686A1

Function 0090E8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 2ea8635efa927eb6bea2339c1d670ddb3018b7eca7d1dab6a7b48746d1663033
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: FC516BB16087548FE314DF69D49435BBBE1BBC9318F044E2DE5E987391E379DA088B82

Function 0093ECD8 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b59b2504c3fc9bc6cfe77c798ad7ebbd216830541c44137e55439b717f9deaa
Instruction ID: b98f0831d8f426e4626eca490b2cfff14e0d2949bd71c89db50d176375343789
Opcode Fuzzy Hash: 0b59b2504c3fc9bc6cfe77c798ad7ebbd216830541c44137e55439b717f9deaa
Instruction Fuzzy Hash: 3151E2F3A082009FF3146E29DC8976AF7EAEF84310F1A453DD6D497784EA7858458792

Function 00917520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd767226c3f93ebe6051932a02b6a5dc76eb9faefeb51d62264d4e0f7d2475d8
Instruction ID: df635a0cbdfea474db4f00489e9ac4cd6c9668c762efce804354b5a5e11238e8
Opcode Fuzzy Hash: fd767226c3f93ebe6051932a02b6a5dc76eb9faefeb51d62264d4e0f7d2475d8
Instruction Fuzzy Hash: 5C51143170C205ABC7159E58DC90B6EF7FAEB85354F288A2CE8D597391D631AC418B92

Function 008D5A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa76bb93065d1e6642d49391767bb17ad99c698659032f5247fbcc48241ea480
Instruction ID: 6c9dd60fbddbc091d102c3d377d89eaa0ef8276f14fce1d25004d16e78b9b94b
Opcode Fuzzy Hash: aa76bb93065d1e6642d49391767bb17ad99c698659032f5247fbcc48241ea480
Instruction Fuzzy Hash: E2519DB5A047159FC714AF18C89092AB7A1FF89328F15476FE899CB352D631EC42CB92

Function 009657FD Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091618b616fb67b834a3de89e8653a684ac801d9d5babe5f9d00d3dafea2d058
Instruction ID: 16253a8b1cfc4ad2cc6b93bd6ad607e5071ca06e9594681fa9a0cbc2e0bf440f
Opcode Fuzzy Hash: 091618b616fb67b834a3de89e8653a684ac801d9d5babe5f9d00d3dafea2d058
Instruction Fuzzy Hash: 39417AB3E153045BE3442D3DDD997B7BB9AE7D4320F2A823DDE8493B8ADC79090A4191

Function 00A8A959 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3db97adcb64648049f81b3f5a201c87dffe44aac4169c3caa7cd6ac32c8a304
Instruction ID: 968dd3dd8daaecea2006ea28367fd611b70ae20813ca8de459101bb57c0f5a47
Opcode Fuzzy Hash: b3db97adcb64648049f81b3f5a201c87dffe44aac4169c3caa7cd6ac32c8a304
Instruction Fuzzy Hash: F041F6F3E582105FF3505969EC59B6BBAD6DBC4320F1B453EEA88C7340E979484682D2

Function 008FEC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f835e8a03af09fbe3e0e6547668a799aa4d799291feaa3791407b8f09e8555
Instruction ID: 56bbac541d81f4835a57e07ac6b3ea925254f626da50fde24c30440a7eb9c66a
Opcode Fuzzy Hash: 02f835e8a03af09fbe3e0e6547668a799aa4d799291feaa3791407b8f09e8555
Instruction Fuzzy Hash: E9419078910319DBDF209F68DC91BBDB7B1FF0A300F144549E945AB3A0EB389951CB91

Function 00919B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba438b841a5c9c8659abadfc0faf7f6f54b5c9aa1ec1bc01b8d42f364ebd9f32
Instruction ID: 3efdf657af19b9c4b2438c3c50f44f33880a5069cf25cd4e62d8c09f705cfabd
Opcode Fuzzy Hash: ba438b841a5c9c8659abadfc0faf7f6f54b5c9aa1ec1bc01b8d42f364ebd9f32
Instruction Fuzzy Hash: 5F41CF3474C308ABD720DB14D9A0B6AB7EAEB85754F14882CF5CA87251D335EC81CBA2

Function 008E2030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbaa272e803da0dd4fd2adb9492ee5f20dbf00871234458ece2903dafcb714b
Instruction ID: 61751f668475d4c4ca110cf78f55fc9b22b3f3afdab956cf6eeb84a1008bd043
Opcode Fuzzy Hash: 5cbaa272e803da0dd4fd2adb9492ee5f20dbf00871234458ece2903dafcb714b
Instruction Fuzzy Hash: 5D41E772A083654FD35DCE2A849027ABBE6BFC5300F09866EE4D6873D0DA758945DB81

Function 008E1E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d98b03461372ea5787dede611b917c5a20b408a876580f5d016a412e557c0d1
Instruction ID: 3e8d19f85698a269a66da83eb39cd0039859e2f7bacb030012f337fd2f555952
Opcode Fuzzy Hash: 5d98b03461372ea5787dede611b917c5a20b408a876580f5d016a412e557c0d1
Instruction Fuzzy Hash: 8541EF7450C3809BD720AB59C888B2EFBF5FB87354F14491CF6C497292C376E8148B66

Function 00918D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0cd571be258ab2e5e0448195cb9a4b1265645b7086400c9c24eb6afcd53ffe2
Instruction ID: 389aec77efdd35258f68c796b2a1fad0534c99c219a9494e56b394dd288134b5
Opcode Fuzzy Hash: b0cd571be258ab2e5e0448195cb9a4b1265645b7086400c9c24eb6afcd53ffe2
Instruction Fuzzy Hash: 7341C03560D3558FC304DF68D49066FFBEAAF9A300F198A1DD4D997291CB74DD418B82

Function 008ED961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d820a025b9ef473670ba597293e579428d22a67911b018e65e89a55c2fce3b7f
Instruction ID: 5592ed7e2df1ec3b803c81d2c9960bc9377eb7fc8da839573b5a49bea0b428a7
Opcode Fuzzy Hash: d820a025b9ef473670ba597293e579428d22a67911b018e65e89a55c2fce3b7f
Instruction Fuzzy Hash: AB41CDB16083958BD3309F15C881BAFB7B0FF96360F044969E88A8B7A2E7744941CB53

Function 0090F030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: 81722e317999e1d23148417b2c1630a93010ba90b7db1b3655bd461477ce2070
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 822107329082248BC3349B59C49163BF7F8EB99704F06863ED9C4A7295E3359D2487E1

Function 009167EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1afd5b61a5c122101d1bbe498a6de6f1167640fb6635eb3d2151d53efaea80f
Instruction ID: e1a08eea28bb59888eec6f6597a7ccb86669057227e36e1a6cac418115c79d77
Opcode Fuzzy Hash: d1afd5b61a5c122101d1bbe498a6de6f1167640fb6635eb3d2151d53efaea80f
Instruction Fuzzy Hash: 4B31137061C3829AE714CF14C49066FFBF0AF96785F54590DF4C8AB261D338D985CB9A

Function 008F5E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a299d63fb267944dd31acc959192c152ed69d3c48582a97241d61e081b161ff
Instruction ID: 51a237060803c31e8682e7c4a0bb9f187db849175ddbbb6177488f90e06dc104
Opcode Fuzzy Hash: 1a299d63fb267944dd31acc959192c152ed69d3c48582a97241d61e081b161ff
Instruction Fuzzy Hash: 2E21AEB45082159BD310AF28C85193BBBF4FF92765F548908F6D9DB292E734CA00CBA3

Function 008D49A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: cd55889ad3520bb74d9be2f0c8da58f24ba92ed6cd06655719ec0ac219b1bfc8
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 3B3105316482119BC7109E19D880A2BB7E1FF84318F18AB2FE8DACB352D331DC42CB46

Function 009164B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311fe51555d7c6fd43e77376e8fd08df0783c82e4fa17232ff488dc52d080c60
Instruction ID: 409c768e93db9c0e61b45c11dcb82789b437ba83e7681b7c1fe8da8b3805f364
Opcode Fuzzy Hash: 311fe51555d7c6fd43e77376e8fd08df0783c82e4fa17232ff488dc52d080c60
Instruction Fuzzy Hash: CC218974A1C205DBC714EF19D580A2EFBFAFB85740F28881CE4C5933A1C334A892DB62

Function 0090B650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 29b047f027df805208c6b4f3b18172f228f5993c4c6ba2146cc04b80aaeb774a
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6A110433A051E90EC3168D3C84405A5BFE31AE3234F6D8399F4B89B2D2D7238D8A8764

Function 00900B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: cc55545bc52b7f1d1ceb6437cc46ecb6b04754b79406a6df5ae2672b30dcbaf2
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: 8A0171F6A003128BEB20AE5594D1B3BB3ACAFC0758F18452DE84697382DB75EC05C692

Function 008FD1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df52f32337d4a0a272372b1fa2e10eaacdefaf4355a56282c0bbb652be86eae
Instruction ID: 15ad03c7b03bfa9af6f930f596644fba350e3a4a45634dc84cf1272be7f2c984
Opcode Fuzzy Hash: 9df52f32337d4a0a272372b1fa2e10eaacdefaf4355a56282c0bbb652be86eae
Instruction Fuzzy Hash: 1A11EFB0418380AFD310DF618484A2FFBE5EBA6714F148C0DF6A49B251C375E815DF56

Function 008D6EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e101337306aafd3eb1f27dc2b229513850814d5580b0bc73cde18ab8940fc8
Instruction ID: 748cba1e8fe665a76312f368dde291e8b3875611d28657ae0387d350dc67e8bd
Opcode Fuzzy Hash: 65e101337306aafd3eb1f27dc2b229513850814d5580b0bc73cde18ab8940fc8
Instruction Fuzzy Hash: 38F02B3A71860D0B6310CEAAA880937B396E7C9354B145639EA40C3301DD71E80191D0

Function 0090B8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 008EC5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 008EB410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 776e985eae3afb5afca4d351bb84df2e188adf4b8fe1b01fca5694fda5eb723a
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: A3F0ECB160459457DF228A969CC0F37BB9CDB87358F190436E845D7183D2615845C3EA

Function 00908220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef6ab8fd8fe5fcb79a4d7f356ae26d3bf16c5e50609c3337ef6c0e634192874
Instruction ID: b493e31aaef271c597e0ee5e8da6aa613d61885e690d1da072c8a315dfb1ee43
Opcode Fuzzy Hash: 9ef6ab8fd8fe5fcb79a4d7f356ae26d3bf16c5e50609c3337ef6c0e634192874
Instruction Fuzzy Hash: FE01D2B05147009FC360EF29C445786BBF8EB08714F408A1DE8EACB680D770A5848B82

Function 00911440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: abb7a26a97e39f38c78ff1affd3bbf43305dc6afc6cb142f01f6b0f8793b2229
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: C7D05E21608321569B648E19A4009B7F7E4EA87F11B89955EF686E3198D230DC81C2A9

Function 008E1ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 774decf3b2976912c23e528f4ddca3f3908c2a48d505a73bae733360ca1d8f77
Instruction ID: 7deb2bed7face99a6034e18a2a17af8d6e5cd5bee19b6443db45dfdaff765c3b
Opcode Fuzzy Hash: 774decf3b2976912c23e528f4ddca3f3908c2a48d505a73bae733360ca1d8f77
Instruction Fuzzy Hash: B6C01234B3D0188B82089F02A8A9472A2B8A30B308700B03ADA02E32B1CA20D406E909

Function 00916094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a167168dff074610a1bae6f6bd7b5516733ff8cb781f4000922ef2327a22acc9
Instruction ID: 0207a0c04f879b2d20fe8a3180e01ac7133b82ea5e17a1f67d98fee06e357c54
Opcode Fuzzy Hash: a167168dff074610a1bae6f6bd7b5516733ff8cb781f4000922ef2327a22acc9
Instruction Fuzzy Hash: 1EC04C3476C004869118CE049961575E2669A97715B25F019C90623255C128D517A51C

Function 008E1A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7116ef4b6c125a594def5eaab30def0a5cf561d53d98c7b8927385b2160c9a
Instruction ID: 9ca4df211de2b50456c9413a839e43102e6bf467775aee9025cab232f5dd8ba7
Opcode Fuzzy Hash: 2a7116ef4b6c125a594def5eaab30def0a5cf561d53d98c7b8927385b2160c9a
Instruction Fuzzy Hash: B1C04C34B7D0588B86448E86A8A9471A2A99307308710703A9603E72B1C560D405D509

Function 00915FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760505999.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1760480543.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550115.0000000000930000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760567569.000000000093A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760582269.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760597712.000000000093C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760711486.0000000000A95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760733843.0000000000A98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760762509.0000000000AB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760784414.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760805876.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760842658.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760859982.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760875755.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760890325.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760904815.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760919880.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760937171.0000000000AD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760954413.0000000000AD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760976533.0000000000AE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761091862.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761120576.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761148875.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761177548.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761205476.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761227913.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761244117.0000000000B04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761264622.0000000000B1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761280730.0000000000B1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761297291.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761313350.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761330471.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761346964.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761364724.0000000000B44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761380448.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761398330.0000000000B4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761414828.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761431907.0000000000B53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761448752.0000000000B55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761464599.0000000000B56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761480916.0000000000B58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761497703.0000000000B59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761515109.0000000000B61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761534078.0000000000B70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761550226.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761568499.0000000000B7D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761586144.0000000000BA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635269.0000000000BB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761652494.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761672028.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761693618.0000000000BD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761710055.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761744997.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761761391.0000000000BE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69db7949d466e15ba3c6c75086cde8ead893dd8f03d5ce352b3a00e5659a4312
Instruction ID: d04d93fef1e687c3063d43de57bcc69c0460695ae7e879efd9e30692a8a4c007
Opcode Fuzzy Hash: 69db7949d466e15ba3c6c75086cde8ead893dd8f03d5ce352b3a00e5659a4312
Instruction Fuzzy Hash: A6C09224B7C0008BA25CCF18DD61935F2BA9B8BA19B14F02DC906A3256D138D51B961C

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 009150FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Function 008DFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 008DD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 00915700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Function 00915BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 0091695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 008E049B Relevance: .3, Instructions: 264
COMMON

Function 00913220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 00913202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON