Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1542330
MD5:	6ed46e743c3d66a8e5e7ad9b60c3f612
SHA1:	1176e419688a7c08b2dfdb1740515c8c43eb9476
SHA256:	a5ccbe169ce05c38d1236d784b6acefdf4c3a187f04f94921b40ef818f2704af
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6316 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6ED46E743C3D66A8E5E7AD9B60C3F612)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bathdoomgaz.store", "licendfilteo.site", "spirittunek.store", "mobbipenju.store", "dissapoiznw.store", "studennotediw.store", "eaglepawnoy.store", "clearancek.site"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:46:52.678520+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.6	63028	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:46:52.614466+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.6	50042	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:46:52.655761+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.6	51958	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:46:52.641441+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.6	49614	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:46:52.703869+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.6	49839	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:46:52.629617+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.6	59159	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:46:52.691213+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.6	53293	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:46:52.667430+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.6	63311	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:46:54.238924+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49711	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com:443/profiles/76561199724331900

URL Reputation: Label: malware

Found malware configuration

Source: file.exe.6316.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["bathdoomgaz.store", "licendfilteo.site", "spirittunek.store", "mobbipenju.store", "dissapoiznw.store", "studennotediw.store", "eaglepawnoy.store", "clearancek.site"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.store
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.store
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.store
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.store
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.store
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.store
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49711 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009F50FA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009BD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009BD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_009F63B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_009F99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_009F695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_009BFCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_009F6094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_009B1000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_009EF030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_009C6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_009F4040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_009DD1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_009C42FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_009D2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_009D2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_009E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_009E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_009E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_009E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_009E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_009E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_009BA300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_009F64B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_009CB410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_009DE40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_009CD457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_009F1440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_009DC470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	0_2_009B8590
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_009D9510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_009C6536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_009F7520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_009EB650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_009DE66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_009DD7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_009F67EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_009F7710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009F5700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_009D28E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_009B49A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_009F3920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_009CD961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_009C1ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_009C1A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_009B5A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_009F4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_009E0B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_009C1BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_009C3BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_009CDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_009CDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_009F9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_009DAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_009DAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_009DCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009DCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_009DCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009F9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_009F9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_009D7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_009EFC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_009DEC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009F8D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_009DFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_009DDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_009C1E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_009C6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_009BBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_009B6EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_009C0EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_009C4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_009DAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009D5E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_009D7E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_009C6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_009CFFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_009F5FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_009B8FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_009F7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009F7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009EFF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_009D9F62

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:50042 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:59159 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:49614 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:51958 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:63311 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:53293 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:63028 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:49839 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49711 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: clearancek.site

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: //api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: //api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C42cb6563c5fec8103907e3e99aebe27b; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=d34521d74e608b32c711c3d2; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26105Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 25 Oct 2024 17:46:54 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.2207134576.0000000001390000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https: equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.2207134576.0000000001390000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https: equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000002.2208686438.000000000134E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/api
Source: file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000002.2208686438.000000000134E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api
Source: file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000002.2208686438.0000000001364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/Q
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000003.2207134576.0000000001390000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/p
Source: file.exe, 00000000.00000002.2208686438.0000000001346000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208686438.0000000001364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000002.2208686438.0000000001364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900q
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000002.2208686438.000000000134E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.2207134576.0000000001390000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C42cb6563c5fec81
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49711 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C0228	0_2_009C0228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FA0D0	0_2_009FA0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B1000	0_2_009B1000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C2030	0_2_009C2030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F4040	0_2_009F4040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BE1A0	0_2_009BE1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B71F0	0_2_009B71F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116	0_2_00B7B116
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B5160	0_2_009B5160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2B2B4	0_2_00A2B2B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E82D0	0_2_009E82D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E12D0	0_2_009E12D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B12F7	0_2_009B12F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA20C	0_2_00AAA20C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7C21E	0_2_00B7C21E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8B27D	0_2_00B8B27D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B11269	0_2_00B11269
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B13A3	0_2_009B13A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BB3A0	0_2_009BB3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B063F8	0_2_00B063F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E23E0	0_2_009E23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BA300	0_2_009BA300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C049B	0_2_009C049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C4487	0_2_009C4487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E64F0	0_2_009E64F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DC470	0_2_009DC470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A265AA	0_2_00A265AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8590	0_2_009B8590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B35B0	0_2_009B35B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CC5F0	0_2_009CC5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B5A575	0_2_00B5A575
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B866A8	0_2_00B866A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F86F0	0_2_009F86F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EF620	0_2_009EF620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F8652	0_2_009F8652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B164F	0_2_009B164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B497C7	0_2_00B497C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADB722	0_2_00ADB722
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6E718	0_2_00B6E718
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EE8A0	0_2_009EE8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EB8C0	0_2_009EB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BA850	0_2_009BA850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7F85D	0_2_00B7F85D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E1860	0_2_009E1860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D098B	0_2_009D098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F89A0	0_2_009F89A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6F9CC	0_2_00B6F9CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F8A80	0_2_009F8A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F7AB0	0_2_009F7AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3EA2A	0_2_00A3EA2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F4A40	0_2_009F4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B78BD2	0_2_00B78BD2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B7BF0	0_2_009B7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CDB6F	0_2_009CDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F6CBF	0_2_009F6CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DCCD0	0_2_009DCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B87C3E	0_2_00B87C3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F8C02	0_2_009F8C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B82C4F	0_2_00B82C4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DFD10	0_2_009DFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DDD29	0_2_009DDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7DD73	0_2_00B7DD73
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D8D62	0_2_009D8D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C6EBF	0_2_009C6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BBEB0	0_2_009BBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4CEC9	0_2_00B4CEC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C4E2A	0_2_009C4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DAE57	0_2_009DAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F8E70	0_2_009F8E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8FD0	0_2_009B8FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F7FC0	0_2_009F7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BAF10	0_2_009BAF10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B84F20	0_2_00B84F20

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 009CD300 appears 152 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 009BCAA0 appears 48 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9994972153465347

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@9/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009E8220 CoCreateInstance,

0_2_009E8220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNe

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior

Source: file.exe

Static file information: File size 2975744 > 1048576

Source: file.exe

Static PE information: Raw size of koxaxysd is bigger than: 0x100000 < 0x2ad000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.9b0000.0.unpack :EW;.rsrc :W;.idata :W;koxaxysd:EW;nzflfbhb:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;koxaxysd:EW;nzflfbhb:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2e021d should be: 0x2d70cc

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: koxaxysd
Source: file.exe	Static PE information: section name: nzflfbhb
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A38098 push 647E6046h; mov dword ptr [esp], eax	0_2_00A380C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C37149 push edi; mov dword ptr [esp], 3EFFA75Eh	0_2_00C37168
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push 3EB7AB1Eh; mov dword ptr [esp], edx	0_2_00B7B147
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push 543A9905h; mov dword ptr [esp], ecx	0_2_00B7B24B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push ebx; mov dword ptr [esp], edi	0_2_00B7B288
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push eax; mov dword ptr [esp], ebp	0_2_00B7B305
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push ecx; mov dword ptr [esp], eax	0_2_00B7B31B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push edi; mov dword ptr [esp], ebx	0_2_00B7B3D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push ebp; mov dword ptr [esp], ecx	0_2_00B7B428
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push edx; mov dword ptr [esp], 3BBDF6CBh	0_2_00B7B47B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push 5BBE7279h; mov dword ptr [esp], edx	0_2_00B7B501
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push 2B8DC5FEh; mov dword ptr [esp], eax	0_2_00B7B523
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push ebp; mov dword ptr [esp], esp	0_2_00B7B52A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push 23509CD1h; mov dword ptr [esp], ebx	0_2_00B7B59F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push eax; mov dword ptr [esp], 00000004h	0_2_00B7B66F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push 66E03BB0h; mov dword ptr [esp], ebp	0_2_00B7B687
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push 06DE359Bh; mov dword ptr [esp], edi	0_2_00B7B6B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push esi; mov dword ptr [esp], 3DF84704h	0_2_00B7B747
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push ebx; mov dword ptr [esp], 329A8BFDh	0_2_00B7B790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push esi; mov dword ptr [esp], ecx	0_2_00B7B862
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push 73936136h; mov dword ptr [esp], ebx	0_2_00B7B8FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push esi; mov dword ptr [esp], ecx	0_2_00B7B90A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push 7C517E59h; mov dword ptr [esp], esp	0_2_00B7B95D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push 5E04B7B8h; mov dword ptr [esp], esi	0_2_00B7B96F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push edx; mov dword ptr [esp], eax	0_2_00B7B9B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B116 push 0C379FBAh; mov dword ptr [esp], ebp	0_2_00B7B9D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A91179 push eax; mov dword ptr [esp], edi	0_2_00A911AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2B2B4 push ebx; mov dword ptr [esp], edi	0_2_00A2B2FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2B2B4 push 0DEB0502h; mov dword ptr [esp], ebp	0_2_00A2B354
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2B2B4 push 2950D470h; mov dword ptr [esp], eax	0_2_00A2B3F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2B2B4 push 58625E60h; mov dword ptr [esp], edi	0_2_00A2B46E

Source: file.exe

Static PE information: section name: entropy: 7.977922440485143

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A146C0 second address: A13EE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007F90CD345EDAh 0x00000010 nop 0x00000011 xor dword ptr [ebp+122D2CF1h], ecx 0x00000017 push dword ptr [ebp+122D0D55h] 0x0000001d sub dword ptr [ebp+122D1D8Fh], esi 0x00000023 call dword ptr [ebp+122D2EC2h] 0x00000029 pushad 0x0000002a cmc 0x0000002b xor eax, eax 0x0000002d cld 0x0000002e mov edx, dword ptr [esp+28h] 0x00000032 sub dword ptr [ebp+122D3688h], edx 0x00000038 mov dword ptr [ebp+122D3B95h], eax 0x0000003e mov dword ptr [ebp+122D1E06h], ecx 0x00000044 jnp 00007F90CD345ED7h 0x0000004a mov esi, 0000003Ch 0x0000004f cmc 0x00000050 add esi, dword ptr [esp+24h] 0x00000054 jmp 00007F90CD345EE8h 0x00000059 lodsw 0x0000005b pushad 0x0000005c mov dx, ax 0x0000005f movzx edi, si 0x00000062 popad 0x00000063 jl 00007F90CD345EDCh 0x00000069 sub dword ptr [ebp+122D1E06h], ebx 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 pushad 0x00000074 add dword ptr [ebp+122D3688h], edi 0x0000007a mov dword ptr [ebp+122D1D5Ch], esi 0x00000080 popad 0x00000081 jns 00007F90CD345EDCh 0x00000087 mov ebx, dword ptr [esp+24h] 0x0000008b mov dword ptr [ebp+122D1D5Ch], ecx 0x00000091 nop 0x00000092 jnc 00007F90CD345EE9h 0x00000098 push eax 0x00000099 pushad 0x0000009a jbe 00007F90CD345EE2h 0x000000a0 jmp 00007F90CD345EDCh 0x000000a5 pushad 0x000000a6 js 00007F90CD345ED6h 0x000000ac push eax 0x000000ad push edx 0x000000ae rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B90131 second address: B90137 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F1C4 second address: B8F1C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F451 second address: B8F459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F743 second address: B8F75D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F90CD345EE0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8FA0E second address: B8FA16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8FA16 second address: B8FA1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92B61 second address: B92B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92B65 second address: B92B69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92B69 second address: B92B6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92B6F second address: B92B75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92B75 second address: B92B79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92BEB second address: B92BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92D45 second address: B92D7C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F90CD33A5F8h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 mov esi, 57F735EFh 0x00000017 mov esi, dword ptr [ebp+122D2D44h] 0x0000001d push 00000000h 0x0000001f jnc 00007F90CD33A5F6h 0x00000025 call 00007F90CD33A5F9h 0x0000002a pushad 0x0000002b jl 00007F90CD33A5FCh 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92D7C second address: B92D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92D84 second address: B92D95 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F90CD33A5F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92D95 second address: B92DC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jmp 00007F90CD345EE4h 0x00000011 push ebx 0x00000012 push edi 0x00000013 pop edi 0x00000014 pop ebx 0x00000015 popad 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pushad 0x0000001c popad 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92DC2 second address: B92DC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92DC8 second address: B92DE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92DE5 second address: B92E59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007F90CD33A5F8h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 00000018h 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 jnp 00007F90CD33A5F6h 0x00000027 push 00000003h 0x00000029 push 00000000h 0x0000002b mov dx, si 0x0000002e push 00000003h 0x00000030 xor dword ptr [ebp+122D2DE1h], edi 0x00000036 call 00007F90CD33A5F9h 0x0000003b pushad 0x0000003c push esi 0x0000003d pushad 0x0000003e popad 0x0000003f pop esi 0x00000040 jng 00007F90CD33A5FCh 0x00000046 popad 0x00000047 push eax 0x00000048 jng 00007F90CD33A602h 0x0000004e mov eax, dword ptr [esp+04h] 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92E59 second address: B92E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92E5D second address: B92E67 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F90CD33A5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92E67 second address: B92E97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jp 00007F90CD345ED6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jc 00007F90CD345EE0h 0x00000014 jmp 00007F90CD345EDAh 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F90CD345EDCh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92E97 second address: B92ECF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov di, C9F8h 0x0000000d lea ebx, dword ptr [ebp+12452A03h] 0x00000013 or dword ptr [ebp+122D2CB8h], ebx 0x00000019 push edx 0x0000001a push ecx 0x0000001b pop edi 0x0000001c pop ecx 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F90CD33A608h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92ECF second address: B92ED5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92ED5 second address: B92ED9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92F7A second address: B92FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D1E06h], esi 0x0000000d push 00000000h 0x0000000f pushad 0x00000010 mov edi, dword ptr [ebp+122D3BE5h] 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 push F3E3A2B4h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 jno 00007F90CD345ED6h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92FA3 second address: B92FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92FA8 second address: B92FF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 0C1C5DCCh 0x00000010 push ecx 0x00000011 mov dword ptr [ebp+122D2CF1h], esi 0x00000017 pop ecx 0x00000018 push 00000003h 0x0000001a mov edi, dword ptr [ebp+122D3B21h] 0x00000020 mov dword ptr [ebp+122D1E1Dh], ebx 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 ja 00007F90CD345EDAh 0x0000002f mov si, 412Fh 0x00000033 pop esi 0x00000034 xor edx, dword ptr [ebp+122D3C31h] 0x0000003a push 00000003h 0x0000003c cmc 0x0000003d push 82AB48C4h 0x00000042 push ecx 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92FF8 second address: B92FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92FFC second address: B93000 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA51FF second address: BA521A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F90CD33A5FCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA521A second address: BA521E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B841C7 second address: B841CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B841CB second address: B841D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B841D7 second address: B84203 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD33A608h 0x00000007 jmp 00007F90CD33A600h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84203 second address: B84225 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F90CD345EDEh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F90CD345EDAh 0x0000000f jns 00007F90CD345ED6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1150 second address: BB1156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1156 second address: BB115E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB115E second address: BB118C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F90CD33A60Ch 0x00000010 push ecx 0x00000011 jno 00007F90CD33A5F6h 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB12D1 second address: BB12F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F90CD345ED6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F90CD345EE9h 0x00000015 jmp 00007F90CD345EE3h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB12F9 second address: BB1309 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F90CD33A602h 0x00000008 jl 00007F90CD33A5F6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8420D second address: B84225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F90CD345EDAh 0x0000000d jns 00007F90CD345ED6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1424 second address: BB1453 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F90CD33A5FEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F90CD33A609h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1453 second address: BB1479 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F90CD345EE8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F90CD345ED6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB16DF second address: BB16E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB16E7 second address: BB171B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jnp 00007F90CD345ED6h 0x0000000e popad 0x0000000f jnc 00007F90CD345ED8h 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 jmp 00007F90CD345EE9h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB18C2 second address: BB18CC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F90CD33A5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB215F second address: BB2169 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F90CD345EDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2169 second address: BB2188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F90CD33A610h 0x0000000c jmp 00007F90CD33A5FEh 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB248F second address: BB2495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2D63 second address: BB2D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2D67 second address: BB2D6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2EEE second address: BB2EF8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F90CD33A5FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB31A4 second address: BB31B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD345EDBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F374 second address: B7F389 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F90CD33A5F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F90CD33A5F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F389 second address: B7F398 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F90CD345ED6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBB642 second address: BBB651 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F90CD33A5FAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF8F8 second address: BBF91B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD345EE5h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF91B second address: BBF91F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2EF2 second address: BC2F0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d jc 00007F90CD345ED6h 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2F0B second address: BC2F11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2F11 second address: BC2F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2F15 second address: BC2F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jc 00007F90CD33A5FAh 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC327D second address: BC3281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC3688 second address: BC368C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC368C second address: BC36A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC3B59 second address: BC3B72 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jno 00007F90CD33A5F6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f js 00007F90CD33A5F6h 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC3BD2 second address: BC3BEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC3BEB second address: BC3BF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC4082 second address: BC4094 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC4216 second address: BC426F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F90CD33A60Dh 0x00000008 jmp 00007F90CD33A607h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F90CD33A5F8h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c and esi, 74E638BCh 0x00000032 mov edi, dword ptr [ebp+122D3BB5h] 0x00000038 push eax 0x00000039 push ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d pop eax 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC4FF7 second address: BC4FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC61E6 second address: BC61EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC58C2 second address: BC58C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC58C6 second address: BC58D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F90CD33A5F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC765E second address: BC766E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 je 00007F90CD345EE0h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC770E second address: BC7712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB8FF second address: BCB903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB903 second address: BCB914 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F90CD33A5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB914 second address: BCB97C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F90CD345EDCh 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F90CD345ED8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 mov di, 8317h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007F90CD345ED8h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 xchg eax, ebx 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d js 00007F90CD345ED6h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB97C second address: BCB994 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD33A600h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC3FE second address: BCC403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC403 second address: BCC417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F90CD33A600h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC417 second address: BCC428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCCD00 second address: BCCD07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCE536 second address: BCE54A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F90CD345EDAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFC07 second address: BCFC11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F90CD33A5F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFC11 second address: BCFC4F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F90CD345ED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov ebx, dword ptr [ebp+122D3A7Dh] 0x00000015 push 00000000h 0x00000017 mov ebx, 5A0C31F1h 0x0000001c push 00000000h 0x0000001e jmp 00007F90CD345EE8h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push edi 0x00000028 pop edi 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFC4F second address: BCFC54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFC54 second address: BCFC66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F90CD345EDEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0C13 second address: BD0C3B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F90CD33A5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F90CD33A60Ah 0x00000014 jmp 00007F90CD33A604h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFE44 second address: BCFE4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFE4A second address: BCFE4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0CB5 second address: BD0CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFE4F second address: BCFE55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0CB9 second address: BD0CBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0CBD second address: BD0CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F90CD33A603h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1B42 second address: BD1B69 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F90CD345EDAh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F90CD345EE3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1B69 second address: BD1B82 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F90CD33A5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F90CD33A5FDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1B82 second address: BD1C05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D3905h], ebx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F90CD345ED8h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d mov bx, dx 0x00000030 push 00000000h 0x00000032 jl 00007F90CD345EE4h 0x00000038 pushad 0x00000039 mov ebx, dword ptr [ebp+122D2E17h] 0x0000003f mov esi, dword ptr [ebp+122D1C61h] 0x00000045 popad 0x00000046 xchg eax, esi 0x00000047 push edi 0x00000048 jmp 00007F90CD345EE6h 0x0000004d pop edi 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 jnl 00007F90CD345EDCh 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1C05 second address: BD1C0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1D35 second address: BD1D39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3A3F second address: BD3A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3C74 second address: BD3C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3C79 second address: BD3CA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F90CD33A600h 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007F90CD33A5FCh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5A47 second address: BD5A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 nop 0x00000006 movsx edi, ax 0x00000009 mov edi, dword ptr [ebp+122D3C75h] 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F90CD345ED8h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov di, B5EBh 0x0000002f push 00000000h 0x00000031 xor ebx, dword ptr [ebp+122D1DC6h] 0x00000037 xchg eax, esi 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5A89 second address: BD5A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD797A second address: BD7996 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F90CD345ED6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD7996 second address: BD79B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F90CD33A608h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD99E7 second address: BD99EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD99EB second address: BD9A21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD33A600h 0x00000007 jmp 00007F90CD33A5FBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F90CD33A602h 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD7B75 second address: BD7C37 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F90CD345EE9h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+1245202Ah], edx 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov edi, dword ptr [ebp+122D5EE9h] 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push edi 0x00000029 sub ebx, 4BC1FA51h 0x0000002f pop ebx 0x00000030 mov eax, dword ptr [ebp+122D0C2Dh] 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007F90CD345ED8h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 00000014h 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 mov dword ptr [ebp+12462A88h], esi 0x00000056 push FFFFFFFFh 0x00000058 push 00000000h 0x0000005a push eax 0x0000005b call 00007F90CD345ED8h 0x00000060 pop eax 0x00000061 mov dword ptr [esp+04h], eax 0x00000065 add dword ptr [esp+04h], 0000001Ah 0x0000006d inc eax 0x0000006e push eax 0x0000006f ret 0x00000070 pop eax 0x00000071 ret 0x00000072 nop 0x00000073 jmp 00007F90CD345EE8h 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007F90CD345EE6h 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDBF2B second address: BDBF2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDB1B2 second address: BDB1B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDD066 second address: BDD06A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDD06A second address: BDD06E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDD06E second address: BDD0D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F90CD33A5F8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 je 00007F90CD33A5F7h 0x0000002a cld 0x0000002b push 00000000h 0x0000002d jmp 00007F90CD33A5FDh 0x00000032 mov edi, dword ptr [ebp+122D3B05h] 0x00000038 push 00000000h 0x0000003a jg 00007F90CD33A5F7h 0x00000040 xchg eax, esi 0x00000041 push eax 0x00000042 push edx 0x00000043 jns 00007F90CD33A608h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDD0D7 second address: BDD0F9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F90CD345EE8h 0x00000008 jmp 00007F90CD345EE2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDE00D second address: BDE014 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDE014 second address: BDE02B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jc 00007F90CD345EE4h 0x0000000e pushad 0x0000000f jbe 00007F90CD345ED6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDE02B second address: BDE0D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push eax 0x00000009 call 00007F90CD33A5F8h 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 add dword ptr [esp+04h], 00000018h 0x0000001b inc eax 0x0000001c push eax 0x0000001d ret 0x0000001e pop eax 0x0000001f ret 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007F90CD33A5F8h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 00000018h 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c mov ebx, dword ptr [ebp+122D3D7Dh] 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push eax 0x00000047 call 00007F90CD33A5F8h 0x0000004c pop eax 0x0000004d mov dword ptr [esp+04h], eax 0x00000051 add dword ptr [esp+04h], 0000001Dh 0x00000059 inc eax 0x0000005a push eax 0x0000005b ret 0x0000005c pop eax 0x0000005d ret 0x0000005e jmp 00007F90CD33A600h 0x00000063 mov dword ptr [ebp+122D393Dh], ebx 0x00000069 xchg eax, esi 0x0000006a pushad 0x0000006b ja 00007F90CD33A5FCh 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007F90CD33A600h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDE0D6 second address: BDE0FF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F90CD345EE7h 0x00000010 jl 00007F90CD345ED6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDD26F second address: BDD275 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDD275 second address: BDD287 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F90CD345EDDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDE388 second address: BDE399 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD33A5FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDF3B9 second address: BDF3BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDF3BF second address: BDF3D2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F90CD33A5F8h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBEBF second address: BEBEC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBEC3 second address: BEBEC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBFA2 second address: BEBFDB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007F90CD345ED6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jg 00007F90CD345EDEh 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F90CD345EE7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBFDB second address: BEBFF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F90CD33A5FDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBFF4 second address: BEC00C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F90CD345ED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF173A second address: BF173E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF173E second address: BF1744 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1C72 second address: BF1C89 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F90CD33A5FBh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1C89 second address: BF1C9D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F90CD345ED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F90CD345ED6h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1F17 second address: BF1F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1F1D second address: BF1F21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF2046 second address: BF204C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF204C second address: BF2052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF2720 second address: BF2727 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF8E86 second address: BF8E8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7A19 second address: BF7A27 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F90CD33A5F8h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7A27 second address: BF7A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7BB0 second address: BF7BB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7BB6 second address: BF7BCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EDDh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7BCD second address: BF7BD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7EB5 second address: BF7EC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F90CD345ED8h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7EC7 second address: BF7ED0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7ED0 second address: BF7EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD345EE0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7EE6 second address: BF7EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 je 00007F90CD33A611h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF8085 second address: BF808A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF808A second address: BF808F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF808F second address: BF80EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F90CD345EE2h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jmp 00007F90CD345EE7h 0x00000019 popad 0x0000001a jmp 00007F90CD345EE9h 0x0000001f jo 00007F90CD345ED8h 0x00000025 pushad 0x00000026 popad 0x00000027 push ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF824A second address: BF8264 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F90CD33A5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b je 00007F90CD33A5F6h 0x00000011 pushad 0x00000012 popad 0x00000013 jnc 00007F90CD33A5F6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF8417 second address: BF843F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F90CD345ED6h 0x00000008 jo 00007F90CD345ED6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F90CD345EE4h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF843F second address: BF8443 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF8CF8 second address: BF8D0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 je 00007F90CD345ED6h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F90CD345ED6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD41B second address: BFD42E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F90CD33A5F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD42E second address: BFD441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD345EDAh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1719 second address: BC171D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC171D second address: BC1721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC181E second address: BC182B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1B4E second address: BC1B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007F90CD345EDEh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1C7A second address: BC1C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1C7E second address: BC1C82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1DF7 second address: BC1E1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD33A608h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007F90CD33A604h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1E1D second address: BC1E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1E23 second address: BC1E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xchg eax, esi 0x00000006 mov dword ptr [ebp+122D1DB5h], edi 0x0000000c nop 0x0000000d jng 00007F90CD33A617h 0x00000013 push eax 0x00000014 push edx 0x00000015 jbe 00007F90CD33A5F6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2174 second address: BC218F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F90CD345EE7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC29B2 second address: BC29C9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F90CD33A5FCh 0x00000008 jp 00007F90CD33A5F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC29C9 second address: BC29CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC29CD second address: BC29D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2ABE second address: BC2AC8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F90CD345ED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2AC8 second address: BC2AFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD33A5FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D2C30h], ecx 0x00000012 lea eax, dword ptr [ebp+124813D1h] 0x00000018 jmp 00007F90CD33A602h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2AFF second address: BC2B05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2B05 second address: BC2B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2B0A second address: BAABDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007F90CD345ED6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f xor edi, 137D1E0Bh 0x00000015 call dword ptr [ebp+122D1C61h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jno 00007F90CD345ED6h 0x00000024 jbe 00007F90CD345ED6h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD840 second address: BFD846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD846 second address: BFD852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F90CD345ED6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD9A8 second address: BFD9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F90CD33A603h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD9C4 second address: BFD9CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD9CA second address: BFD9CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFDB56 second address: BFDB6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFDCB1 second address: BFDCBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F90CD33A5F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFDF91 second address: BFDF95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE0C4 second address: BFE0C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE0C8 second address: BFE0CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE0CE second address: BFE0EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F90CD33A5FEh 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE0EC second address: BFE104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD345EE3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C019CC second address: C019DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F90CD33A5FCh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C019DD second address: C019E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C019E3 second address: C019ED instructions: 0x00000000 rdtsc 0x00000002 js 00007F90CD33A5F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C019ED second address: C019F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C019F7 second address: C019FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C019FD second address: C01A3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F90CD345EE0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push esi 0x0000000f jmp 00007F90CD345EE9h 0x00000014 pop esi 0x00000015 pushad 0x00000016 jl 00007F90CD345ED6h 0x0000001c push edx 0x0000001d pop edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B827A5 second address: B827D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD33A602h 0x00000007 jmp 00007F90CD33A5FEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 jne 00007F90CD33A5F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89244 second address: B8925B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD345EE1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8925B second address: B89266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89266 second address: B89283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD345EE9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89283 second address: B892B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD33A604h 0x00000007 jng 00007F90CD33A5F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F90CD33A601h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0A069 second address: C0A073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F90CD345ED6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0A073 second address: C0A09A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F90CD33A60Eh 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C08E9F second address: C08EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09030 second address: C09035 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09035 second address: C0904F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD345EDCh 0x00000009 ja 00007F90CD345ED6h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0945C second address: C09465 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C08A46 second address: C08A56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F90CD345ED6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C08A56 second address: C08A5C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C08A5C second address: C08A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C08A68 second address: C08A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C099EE second address: C099F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09D0B second address: C09D0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09D0F second address: C09D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 jno 00007F90CD345ED6h 0x0000000f pop ecx 0x00000010 pushad 0x00000011 jg 00007F90CD345ED6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09D28 second address: C09D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09D2E second address: C09D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F90CD345EE9h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0D043 second address: C0D049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0D049 second address: C0D05A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F90CD345ED6h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0D05A second address: C0D064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F90CD33A5F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0F17B second address: C0F185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0F185 second address: C0F19E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD33A5FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F90CD33A5FEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1423C second address: C14242 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14242 second address: C14280 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F90CD33A5FFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F90CD33A5FAh 0x00000011 jmp 00007F90CD33A605h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push ecx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14280 second address: C14286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14408 second address: C1440C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1440C second address: C14412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1455B second address: C14573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F90CD33A601h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C146D5 second address: C146EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EE3h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C146EE second address: C146F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17CCF second address: C17CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1756E second address: C1758C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD33A608h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1758C second address: C1759C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F90CD345ED6h 0x0000000a jno 00007F90CD345ED6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1759C second address: C175A2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C176DC second address: C176E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C176E0 second address: C176F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD33A5FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C176F3 second address: C176FD instructions: 0x00000000 rdtsc 0x00000002 je 00007F90CD345EDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C179C5 second address: C179CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C179CD second address: C179F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jno 00007F90CD345EEEh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C179F6 second address: C179FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C179FC second address: C17A08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17A08 second address: C17A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F90CD33A607h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17A24 second address: C17A3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F90CD345ED6h 0x00000009 jmp 00007F90CD345EDBh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17A3D second address: C17A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD33A608h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1D67B second address: C1D681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C0BC second address: C1C0C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C0C0 second address: C1C0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C0C6 second address: C1C0CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C4AE second address: C1C4B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C4B4 second address: C1C4DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD33A609h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C4DD second address: C1C4E7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F90CD345ED6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C4E7 second address: C1C4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C4ED second address: C1C4F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C4F2 second address: C1C500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC23BA second address: BC23C4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F90CD345ED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC23C4 second address: BC2433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F90CD33A601h 0x00000010 mov ebx, dword ptr [ebp+12481410h] 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F90CD33A5F8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D2BFBh], edx 0x00000036 jbe 00007F90CD33A5F8h 0x0000003c mov ecx, edi 0x0000003e mov edi, 5AF5BD40h 0x00000043 add eax, ebx 0x00000045 jmp 00007F90CD33A5FDh 0x0000004a add dx, 91BEh 0x0000004f push eax 0x00000050 push ecx 0x00000051 push edi 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2433 second address: BC2462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D2FF1h], ecx 0x0000000f push 00000004h 0x00000011 jmp 00007F90CD345EDDh 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F90CD345EDCh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2462 second address: BC2466 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2466 second address: BC246C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C8A8 second address: C1C8AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C24461 second address: C24485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F90CD345EE7h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C24600 second address: C24615 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F90CD33A5F6h 0x00000009 jmp 00007F90CD33A5FAh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C248BC second address: C248C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C248C2 second address: C248C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C248C8 second address: C248DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F90CD345EDDh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C248DC second address: C248E6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F90CD33A5F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C248E6 second address: C248F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C24BAA second address: C24BAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C24BAE second address: C24BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C24BB4 second address: C24BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F90CD33A5F6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C24BC4 second address: C24BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C24F02 second address: C24F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C251AA second address: C251AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C251AE second address: C251C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b js 00007F90CD33A5F6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C254D4 second address: C254E4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F90CD345ED6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C257DD second address: C257E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25DD1 second address: C25DF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F90CD345EE8h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25DF4 second address: C25DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2D142 second address: C2D15A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EE3h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2D15A second address: C2D160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C305FC second address: C30600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30600 second address: C30604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30604 second address: C3060A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3060A second address: C30613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30613 second address: C30653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F90CD345EE2h 0x0000000b popad 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F90CD345EE9h 0x00000014 jmp 00007F90CD345EDBh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30653 second address: C30658 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30926 second address: C3092C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30BFC second address: C30C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30C01 second address: C30C1F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F90CD345EE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F90CD345ED6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30EC4 second address: C30ECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30ECA second address: C30ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C377F0 second address: C3780F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F90CD33A605h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3780F second address: C37813 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37813 second address: C37819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3798A second address: C37990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37D9D second address: C37DB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F90CD33A604h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37EFB second address: C37F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37F01 second address: C37F0F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F90CD33A5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37F0F second address: C37F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37F13 second address: C37F1D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F90CD33A5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C36C54 second address: C36C6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F90CD345ED6h 0x00000009 jg 00007F90CD345ED6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jns 00007F90CD345ED6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C36C6E second address: C36C72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3D08E second address: C3D092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3D092 second address: C3D0B3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F90CD33A5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F90CD33A600h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3D0B3 second address: C3D0B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3D0B7 second address: C3D0CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD33A5FEh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D7AE second address: C4D7B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D7B3 second address: C4D7BD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F90CD33A60Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51839 second address: C5183F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55020 second address: C55024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C59990 second address: C59999 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C59999 second address: C599DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F90CD33A5F6h 0x0000000a pop ebx 0x0000000b popad 0x0000000c pushad 0x0000000d push edx 0x0000000e jmp 00007F90CD33A5FEh 0x00000013 pop edx 0x00000014 jmp 00007F90CD33A603h 0x00000019 jnc 00007F90CD33A5FCh 0x0000001f push eax 0x00000020 push edx 0x00000021 push edx 0x00000022 pop edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C599DB second address: C599DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5BD3C second address: C5BD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69966 second address: C6996E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69AC0 second address: C69AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69C1B second address: C69C28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69D7F second address: C69DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F90CD33A603h 0x0000000a pushad 0x0000000b jmp 00007F90CD33A5FAh 0x00000010 pushad 0x00000011 popad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69DAC second address: C69DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69DB2 second address: C69DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnl 00007F90CD33A5F8h 0x0000000b push edi 0x0000000c push edx 0x0000000d pop edx 0x0000000e je 00007F90CD33A5F6h 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69DCD second address: C69DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69DD3 second address: C69DD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69F2B second address: C69F39 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F90CD345ED8h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69F39 second address: C69F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6FFB9 second address: C6FFE5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F90CD345ED8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F90CD345EEEh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6FFE5 second address: C6FFEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F90CD33A5F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6FFEF second address: C6FFF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6FCC4 second address: C6FCCE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F90CD33A5F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6FCCE second address: C6FD12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jnc 00007F90CD345ED6h 0x00000010 pushad 0x00000011 popad 0x00000012 jbe 00007F90CD345ED6h 0x00000018 jmp 00007F90CD345EDBh 0x0000001d popad 0x0000001e push edx 0x0000001f jmp 00007F90CD345EE8h 0x00000024 je 00007F90CD345ED6h 0x0000002a pop edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C834E1 second address: C834E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C834E7 second address: C8351E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F90CD345EDCh 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007F90CD345EE0h 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D4C7 second address: C7D4CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C90490 second address: C904B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EE4h 0x00000007 jbe 00007F90CD345ED6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6035 second address: CA603F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F90CD33A5F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAACEF second address: CAACF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAACF5 second address: CAACF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9BB3 second address: CA9BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F90CD345ED6h 0x0000000a jmp 00007F90CD345EE8h 0x0000000f popad 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jns 00007F90CD345ED6h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pushad 0x0000001d jns 00007F90CD345ED6h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9D82 second address: CA9D8F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F90CD33A5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9D8F second address: CA9D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA3F9 second address: CAA407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F90CD33A5FAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA407 second address: CAA435 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EE3h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F90CD345EE3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA435 second address: CAA439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA5C1 second address: CAA5DE instructions: 0x00000000 rdtsc 0x00000002 js 00007F90CD345ED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jmp 00007F90CD345EDBh 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA5DE second address: CAA5EE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F90CD33A5F6h 0x00000008 js 00007F90CD33A5F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA8A9 second address: CAA8B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC3CC second address: CAC3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC3D2 second address: CAC3D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC3D8 second address: CAC3F5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F90CD33A608h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAF2C8 second address: CAF2CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB05C2 second address: CB05CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F90CD33A5F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB05CE second address: CB05EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F90CD345EE5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2276 second address: CB22F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD33A607h 0x00000007 jmp 00007F90CD33A606h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jg 00007F90CD33A603h 0x00000015 jbe 00007F90CD33A612h 0x0000001b jmp 00007F90CD33A606h 0x00000020 ja 00007F90CD33A5F6h 0x00000026 pushad 0x00000027 push esi 0x00000028 pop esi 0x00000029 pushad 0x0000002a popad 0x0000002b jg 00007F90CD33A5F6h 0x00000031 jp 00007F90CD33A5F6h 0x00000037 popad 0x00000038 push eax 0x00000039 push edx 0x0000003a jnl 00007F90CD33A5F6h 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260D2C second address: 5260D36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 4BD3DA62h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260D36 second address: 5260D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, dword ptr [eax+00000FDCh] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260D49 second address: 5260D59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD345EDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A13E39 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A13F2C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BC179A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C443BE instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 2096

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: file.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2208686438.000000000130E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: file.exe, 00000000.00000002.2208875556.0000000001378000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2208875556.0000000001378000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: file.exe	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009F5BB0 LdrInitializeThunk,

0_2_009F5BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: bathdoomgaz.store
Source: file.exe	String found in binary or memory: spirittunek.store
Source: file.exe	String found in binary or memory: dissapoiznw.store
Source: file.exe	String found in binary or memory: studennotediw.store
Source: file.exe	String found in binary or memory: mobbipenju.store
Source: file.exe	String found in binary or memory: eaglepawnoy.store

Source: file.exe, 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: QProgram Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://steamcommunity.com:443/profiles/76561199724331900	100%	URL Reputation	malware
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
eaglepawnoy.store	unknown	unknown	true	unknown
bathdoomgaz.store	unknown	unknown	true	unknown
spirittunek.store	unknown	unknown	true	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	true	unknown
mobbipenju.store	unknown	unknown	true	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
bathdoomgaz.store	true	unknown
studennotediw.store	true	unknown
clearancek.site	true	unknown
dissapoiznw.store	true	unknown
https://steamcommunity.com/profiles/76561199724331900	true	unknown
spirittunek.store	true	unknown
licendfilteo.site	true	unknown
eaglepawnoy.store	true	unknown
mobbipenju.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://player.vimeo.com	file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/Q	file.exe, 00000000.00000002.2208686438.0000000001364000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://clearancek.site:443/api	file.exe, 00000000.00000002.2208686438.000000000134E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900q	file.exe, 00000000.00000002.2208686438.0000000001364000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steam.tv/	file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://licendfilteo.site:443/api	file.exe, 00000000.00000002.2208686438.000000000134E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/p	file.exe, 00000000.00000003.2207134576.0000000001390000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com:443/profiles/76561199724331900	file.exe, 00000000.00000002.2208686438.000000000134E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C42cb6563c5fec81	file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/	file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/	file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208934805.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207134576.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;	file.exe, 00000000.00000003.2207134576.0000000001390000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2207088710.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.2207064860.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/	file.exe, 00000000.00000002.2208875556.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542330
Start date and time:	2024-10-25 19:45:54 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@9/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:46:52	API Interceptor	2x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ldr_clp.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	104.102.49.254
	ldr_clp.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	3rd_cc_form_Oct_2024.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	Fanduel CO Player Location Check F.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form.eml	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ldr_clp.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	104.102.49.254
	ldr_clp.exe	Get hash	malicious	Unknown	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	setupbatterycare.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ldr_clp.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	104.102.49.254
	Agreement for YouTube cooperation.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	104.102.49.254
	ldr_clp.exe	Get hash	malicious	Unknown	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.48484290595724
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'975'744 bytes
MD5:	6ed46e743c3d66a8e5e7ad9b60c3f612
SHA1:	1176e419688a7c08b2dfdb1740515c8c43eb9476
SHA256:	a5ccbe169ce05c38d1236d784b6acefdf4c3a187f04f94921b40ef818f2704af
SHA512:	05a9fb1493832ed8f11c5fd40b4d954e317d6a904bbf9d483b896f7fd455d3656f2a658e5bb265535b6e83a79480125b4510a3fe50e34e693eff8d453c2e9bf6
SSDEEP:	49152:DYeJm+7r5Zo4/hnti0yJM8LIG+q5zUg7XvOfovUn:DYT+P5Zo4pnti0yGSbzU6vOQv4
TLSH:	81D54AE2B40571CFE48A17788467CD42696D06B91F2B59C3B82C74BEBF63CC116B6D28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................1...........@.................................W...k..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F90CCAEC11Ah
cmovbe ebp, dword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	d7250b8e76537e80acc06cdb38592d0f	False	0.9994972153465347	data	7.977922440485143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
koxaxysd	0x60000	0x2ad000	0x2ad000	326470764100da30743fb596412c4079	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nzflfbhb	0x30d000	0x1000	0x600	c77fa017e77d917c2cee190ca1f6103c	False	0.591796875	data	5.088323128445094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30e000	0x3000	0x2200	83410452c13f252d6437a1762a55d286	False	0.03619025735294118	DOS executable (COM)	0.3495444191873696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T19:46:52.614466+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.6	50042	1.1.1.1	53	UDP
2024-10-25T19:46:52.629617+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.6	59159	1.1.1.1	53	UDP
2024-10-25T19:46:52.641441+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.6	49614	1.1.1.1	53	UDP
2024-10-25T19:46:52.655761+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.6	51958	1.1.1.1	53	UDP
2024-10-25T19:46:52.667430+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.6	63311	1.1.1.1	53	UDP
2024-10-25T19:46:52.678520+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.6	63028	1.1.1.1	53	UDP
2024-10-25T19:46:52.691213+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.6	53293	1.1.1.1	53	UDP
2024-10-25T19:46:52.703869+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.6	49839	1.1.1.1	53	UDP
2024-10-25T19:46:54.238924+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49711	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 19:46:52.738957882 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:52.739011049 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:52.739079952 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:52.742141962 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:52.742157936 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:53.582143068 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:53.582230091 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:53.597832918 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:53.597866058 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:53.598150969 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:53.638979912 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:53.652981043 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:53.695346117 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:54.239038944 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:54.239068031 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:54.239094973 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:54.239104033 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:54.239113092 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:54.239157915 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:54.239164114 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:54.239212036 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:54.239237070 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:54.239274979 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:54.246443033 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:54.246501923 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:54.246514082 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:54.246525049 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:54.246539116 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 25, 2024 19:46:54.246552944 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:54.246589899 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:54.247453928 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 25, 2024 19:46:54.247468948 CEST	443	49711	104.102.49.254	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 19:46:52.614465952 CEST	50042	53	192.168.2.6	1.1.1.1
Oct 25, 2024 19:46:52.624912977 CEST	53	50042	1.1.1.1	192.168.2.6
Oct 25, 2024 19:46:52.629616976 CEST	59159	53	192.168.2.6	1.1.1.1
Oct 25, 2024 19:46:52.639791012 CEST	53	59159	1.1.1.1	192.168.2.6
Oct 25, 2024 19:46:52.641441107 CEST	49614	53	192.168.2.6	1.1.1.1
Oct 25, 2024 19:46:52.650897980 CEST	53	49614	1.1.1.1	192.168.2.6
Oct 25, 2024 19:46:52.655761003 CEST	51958	53	192.168.2.6	1.1.1.1
Oct 25, 2024 19:46:52.666253090 CEST	53	51958	1.1.1.1	192.168.2.6
Oct 25, 2024 19:46:52.667429924 CEST	63311	53	192.168.2.6	1.1.1.1
Oct 25, 2024 19:46:52.677261114 CEST	53	63311	1.1.1.1	192.168.2.6
Oct 25, 2024 19:46:52.678519964 CEST	63028	53	192.168.2.6	1.1.1.1
Oct 25, 2024 19:46:52.688529968 CEST	53	63028	1.1.1.1	192.168.2.6
Oct 25, 2024 19:46:52.691212893 CEST	53293	53	192.168.2.6	1.1.1.1
Oct 25, 2024 19:46:52.701267958 CEST	53	53293	1.1.1.1	192.168.2.6
Oct 25, 2024 19:46:52.703869104 CEST	49839	53	192.168.2.6	1.1.1.1
Oct 25, 2024 19:46:52.716918945 CEST	53	49839	1.1.1.1	192.168.2.6
Oct 25, 2024 19:46:52.720438004 CEST	61481	53	192.168.2.6	1.1.1.1
Oct 25, 2024 19:46:52.733314037 CEST	53	61481	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 19:46:52.614465952 CEST	192.168.2.6	1.1.1.1	0x71dc	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.629616976 CEST	192.168.2.6	1.1.1.1	0x1649	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.641441107 CEST	192.168.2.6	1.1.1.1	0x846b	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.655761003 CEST	192.168.2.6	1.1.1.1	0x28d	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.667429924 CEST	192.168.2.6	1.1.1.1	0xabcf	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.678519964 CEST	192.168.2.6	1.1.1.1	0xf609	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.691212893 CEST	192.168.2.6	1.1.1.1	0xbc88	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.703869104 CEST	192.168.2.6	1.1.1.1	0xf544	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.720438004 CEST	192.168.2.6	1.1.1.1	0x805c	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 19:46:52.624912977 CEST	1.1.1.1	192.168.2.6	0x71dc	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.639791012 CEST	1.1.1.1	192.168.2.6	0x1649	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.650897980 CEST	1.1.1.1	192.168.2.6	0x846b	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.666253090 CEST	1.1.1.1	192.168.2.6	0x28d	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.677261114 CEST	1.1.1.1	192.168.2.6	0xabcf	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.688529968 CEST	1.1.1.1	192.168.2.6	0xf609	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.701267958 CEST	1.1.1.1	192.168.2.6	0xbc88	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.716918945 CEST	1.1.1.1	192.168.2.6	0xf544	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:52.733314037 CEST	1.1.1.1	192.168.2.6	0x805c	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	104.102.49.254	443	6316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 17:46:53 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-25 17:46:54 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 25 Oct 2024 17:46:54 GMT Content-Length: 26105 Connection: close Set-Cookie: sessionid=d34521d74e608b32c711c3d2; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C42cb6563c5fec8103907e3e99aebe27b; Path=/; Secure; HttpOnly; SameSite=None
2024-10-25 17:46:54 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-25 17:46:54 UTC	11638	IN	Data Raw: 22 3f 6c 3d 74 63 68 69 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 63 68 69 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e7 b9 81 e9 ab 94 e4 b8 ad e6 96 87 20 28 54 72 61 64 69 74 69 6f 6e 61 6c 20 43 68 69 6e 65 73 65 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 6a 61 70 61 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6a 61 70 61 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e6 97 a5 e6 9c ac e8 aa 9e 20 28 4a Data Ascii: "?l=tchinese" onclick="ChangeLanguage( 'tchinese' ); return false;"> (Traditional Chinese)</a><a class="popup_menu_item tight" href="?l=japanese" onclick="ChangeLanguage( 'japanese' ); return false;"> (J

Target ID:	0
Start time:	13:46:49
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x9b0000
File size:	2'975'744 bytes
MD5 hash:	6ED46E743C3D66A8E5E7AD9B60C3F612
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	57.8%
Total number of Nodes:	45
Total number of Limit Nodes:	5

Executed Functions

Function 009F50FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(19A41BB1,00000000,00000800), ref: 009F5182

Strings

<I$), xrefs: 009F5198
<I$), xrefs: 009F52E3
@^, xrefs: 009F5120

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: <I$)$<I$)$@^
API String ID: 1029625771-935358343
Opcode ID: 3af1fb9fe732aa346faae173c52579f8ecae0f85f0850de6a756c5f56c345255
Instruction ID: 104c771b40c14b18fae7285a51ea4a17f17d62abf9769378d3a536741bcb499b
Opcode Fuzzy Hash: 3af1fb9fe732aa346faae173c52579f8ecae0f85f0850de6a756c5f56c345255
Instruction Fuzzy Hash: D921A1351083888FC700DFA8D8C076ABBE8AB5A300F69882CE2C5D7351D736D916CB56

Function 009BFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

VY^_, xrefs: 009BFDFF
V, xrefs: 009BFEDC
t, xrefs: 009BFCBE
J|BJ, xrefs: 009C000D

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 7b775eb5d19f3429d21cb80ad3ccb6775beca376e97f62e4e38b5eafb2dae930
Instruction ID: efca9bae05052674d67a63420ae7c3bf5aea1a0f16fa0e90b6c654bf7d3c44c8
Opcode Fuzzy Hash: 7b775eb5d19f3429d21cb80ad3ccb6775beca376e97f62e4e38b5eafb2dae930
Instruction Fuzzy Hash: 7AD1567490C3809BD311DF189994B6FBBE5ABD6B44F18881CE4C98B252C336DD09DB93

Function 009BD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 009BD2F0

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 5b412a4c5431359cc662fa106b9ee35a00ee995dd4e69ead50773d00e1fdd2a3
Instruction ID: 3d6ef5bd61c08ec8a21aff8855d39e8a3c4941ae3cb2932845810eaf4f666023
Opcode Fuzzy Hash: 5b412a4c5431359cc662fa106b9ee35a00ee995dd4e69ead50773d00e1fdd2a3
Instruction Fuzzy Hash: F741467040E380ABC701BB68D685A6EFBF9EF92715F148C1CE5C497252E33AD8149B67

Function 009F5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(009F973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 009F5BDE

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 009F695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 009F69C5

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: e847ff2b0dc172e3aa6c65f638c1a625196be477a57c2b65122c4f1e516b3489
Instruction ID: 9d33b8945dac2ec6e83a303c59e2e23bf16ab8d550ea1de4a16125db744b5157
Opcode Fuzzy Hash: e847ff2b0dc172e3aa6c65f638c1a625196be477a57c2b65122c4f1e516b3489
Instruction Fuzzy Hash: 3B31A5B19083099FD708DF28C8A073BB7E5EF84344F48881CE6C6A72A1E338D915CB56

Function 009C049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5176600a889ec75b7c0a69939d2f157b86de862e1cc6a746d80984decede81f
Instruction ID: 938e241de82b63be5b9fea86fb9804c0064a0a691af79722f4c0e53cd49a3c8f
Opcode Fuzzy Hash: f5176600a889ec75b7c0a69939d2f157b86de862e1cc6a746d80984decede81f
Instruction Fuzzy Hash: CD918C75210B00DFD724CF25E894B26B7F6FF89310F158A6CE9568BAA1DB31E816CB50

Function 009C0228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ff00b738393559a1c0fbac0157906fbf200307d538f421852a9acdbf0bbd44b
Instruction ID: 0b1664ce2ff07f5c30eda7b2a7c6f17628fb321f2dc11ed78b904f1c05193838
Opcode Fuzzy Hash: 0ff00b738393559a1c0fbac0157906fbf200307d538f421852a9acdbf0bbd44b
Instruction Fuzzy Hash: ED719A74214B00DFD724CF60E8A4F26B7F6FF89310F14896CE9568BA62CB31A816CB50

Function 009F99D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d163929f964ca55aaa0eb5a6b5ff7c5014788e94ba955a1d25ae4c37037b987
Instruction ID: 42239baffabb1ca7e1abc431857b9e046f93fb355f7774c2d54f41d7ea07a691
Opcode Fuzzy Hash: 1d163929f964ca55aaa0eb5a6b5ff7c5014788e94ba955a1d25ae4c37037b987
Instruction Fuzzy Hash: 6141BE34608308ABD714DF55E890B3BB7EAEB85715F64882CF68A97251D331EC12DF62

Function 009F63B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 552107f80ec8637f312f802d0f0313c2e5783d35e7a5ed1ce493a308226fa68b
Instruction ID: edfbdf12ff70f9b75f8434ec0b4f7a5d3b0551db68c1f4fd1f83ce015bddd3d6
Opcode Fuzzy Hash: 552107f80ec8637f312f802d0f0313c2e5783d35e7a5ed1ce493a308226fa68b
Instruction Fuzzy Hash: 6931E670649305BBDA24DB54CD81F3BB7A9FB80B51F64491CF381572E1D370AC129B52

Function 009F3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 009F32A6

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: cd57749453cc3731765eb3f4c8b87eeeb22afc445768236b3a8a1981412fd728
Instruction ID: 72ebb69e1db85decc939d3df067cac303534044d8ec1b7222ada269550b71813
Opcode Fuzzy Hash: cd57749453cc3731765eb3f4c8b87eeeb22afc445768236b3a8a1981412fd728
Instruction Fuzzy Hash: 91016D3450D2449BC701EF58E885A2ABBE8EF4A700F05891CE6C58B361D335DD61CB92

Function 009F3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 009F3208

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cc9f37842a463f9ab26113ec1ac14c14a2ba7e573e67b26dbb47905be6a50356
Instruction ID: eedd79f2652ec57bd5ad60c178d3b69847a73332d84eb7f7d872dfe1912ead04
Opcode Fuzzy Hash: cc9f37842a463f9ab26113ec1ac14c14a2ba7e573e67b26dbb47905be6a50356
Instruction Fuzzy Hash: 8EB012300400005FDA041B40EC0AF003510EB00705F800050B100140B1D1615866C555

Non-executed Functions

Function 009E23E0 Relevance: 33.0, APIs: 4, Strings: 13, Instructions: 3298COMMON

Download Yara Rule

Strings

f@~!, xrefs: 009E25FF
mlc@, xrefs: 009E275C
:, xrefs: 009E32DD
ggxz, xrefs: 009E2685
%*+(, xrefs: 009E40EF
fedc, xrefs: 009E2782
#v, xrefs: 009E344B, 009E4861
3<, xrefs: 009E32D6
aenQ, xrefs: 009E276A
|}&C, xrefs: 009E2F21
`tii, xrefs: 009E2693
Cx, xrefs: 009E453D
{l`~, xrefs: 009E268C

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C$#v
API String ID: 0-2260822535
Opcode ID: 280e706cb5ef190ace91993c84d64d6b0acaa4278bc34fee4e319c8a9e41e6e5
Instruction ID: f7d113800304e88a36250804c41a9e5711cc7d40b3b56cd07ba13681b2359258
Opcode Fuzzy Hash: 280e706cb5ef190ace91993c84d64d6b0acaa4278bc34fee4e319c8a9e41e6e5
Instruction Fuzzy Hash: 6833CD70504B81CFD7268F3AC590762BBE1BF56304F58899DE4DA8BB92C735E806CB61

Function 009CDB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

`Y^_, xrefs: 009CE99E
%*+(, xrefs: 009CDE37, 009CDE46
()./, xrefs: 009CE9CA
QNOL, xrefs: 009CE775
@ONM, xrefs: 009CE6DB
D, xrefs: 009CE846
AR, xrefs: 009CDD10
mjkh, xrefs: 009CE7D8
DCBA, xrefs: 009CE887, 009CE896
`onm, xrefs: 009CE733
89>?, xrefs: 009CE9F6
:WUE, xrefs: 009CF6B7, 009CF6C6
<=:;, xrefs: 009CE930
<=2, xrefs: 009CEA01
WP, xrefs: 009CDCEF
dcba, xrefs: 009CE728
xgfe, xrefs: 009CE71D
|, xrefs: 009CECB1
T, xrefs: 009CF157
tsrq, xrefs: 009CE6FC
89&', xrefs: 009CE93B
LKJI, xrefs: 009CE6E6
lkji, xrefs: 009CE73E
tuJK, xrefs: 009CE967

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: 645e3ae228abd30ac8bbe0a539d01f0547745a1d09c09cf9139d348365b896c5
Instruction ID: 16d03b1291840517c799e69e6197755e1e4e909b8cc2782ba71c3755c73ac2bc
Opcode Fuzzy Hash: 645e3ae228abd30ac8bbe0a539d01f0547745a1d09c09cf9139d348365b896c5
Instruction Fuzzy Hash: 5EF266B09093819BD770CF14C894BABBBE6AFD5304F148C2DE5C98B292D7359985CB93

Function 009D9F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

%e6g, xrefs: 009DA152
=], xrefs: 009DA36A
Gt, xrefs: 009D9FF8
?m,o, xrefs: 009DA13C
(a*c, xrefs: 009DA147
S], xrefs: 009DA636
WH, xrefs: 009DAA1C
kW, xrefs: 009DA380
sm, xrefs: 009DA830
]{, xrefs: 009DA1E7, 009DA1F3
N[, xrefs: 009DA375
WQ, xrefs: 009DA62B
_Y, xrefs: 009DA641
/), xrefs: 009DA66D
hi, xrefs: 009DAB9D
JG, xrefs: 009DAA27
CG, xrefs: 009DAA32

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 50237f1d962bb97b755492dda907b3264259b54573514e6ef22005ef114d6ec1
Instruction ID: cf9234f5db92c2ff5ee5c1ad37380710fba8581488e2e803508eb9b4b193030f
Opcode Fuzzy Hash: 50237f1d962bb97b755492dda907b3264259b54573514e6ef22005ef114d6ec1
Instruction Fuzzy Hash: 8F52B7B444D385CAE270CF25D581B8EBAF1BB92740F608A1EE1ED5B255DB708045CF93

Function 009D9510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

z=Q?, xrefs: 009D9826
;IJK, xrefs: 009D983E
?M0K, xrefs: 009D9968
L3Y=, xrefs: 009D9B03
B?Q9, xrefs: 009D9B0B
B7U1, xrefs: 009D9AFB
pq, xrefs: 009D99E0
G+X5, xrefs: 009D9AF3
!E4G, xrefs: 009D9836
2A"_, xrefs: 009D9980
X/R), xrefs: 009D9AEB
G'M!, xrefs: 009D9ADB
O+f), xrefs: 009D9634, 009D963D
8;, xrefs: 009D9B13
T#a-, xrefs: 009D9AE3
,A&C, xrefs: 009D982E

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: e9fd2c64658ceb271614aa4b09aa92db7a33cd5f34a100133869faafb67d0f3d
Instruction ID: a072afa2e0b432793afe0aef5ddeef576ae1b23b975cb8766f85c769cf9ea63b
Opcode Fuzzy Hash: e9fd2c64658ceb271614aa4b09aa92db7a33cd5f34a100133869faafb67d0f3d
Instruction Fuzzy Hash: 72F13DB4408385ABD310EF55D880A2BBBF4BB86B88F448D1DF4D99B352D334D909DB96

Function 009DDD29 Relevance: 14.9, Strings: 11, Instructions: 1142COMMON

Download Yara Rule

Strings

=]+_, xrefs: 009DE276
%*+(, xrefs: 009DE143
,Q?S, xrefs: 009DE26F
)IgK, xrefs: 009DE261
Y9N;, xrefs: 009DE245
hX]N, xrefs: 009DDDC7
upH}, xrefs: 009DDE8A, 009DE798, 009DDF4A
-M2O, xrefs: 009DE25A
n\+H, xrefs: 009DDDC0
{E, xrefs: 009DE323
<Y.[, xrefs: 009DE27D

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$upH}${E
API String ID: 0-1557708024
Opcode ID: f35863d7baa08c152ed363b56dfa28c47e0b16f2e7b909d745fc365fa178a92e
Instruction ID: 4d64db64820acd5cbeb4b0ec6b87edc65cb49cb290b9695635fc61b9db34c055
Opcode Fuzzy Hash: f35863d7baa08c152ed363b56dfa28c47e0b16f2e7b909d745fc365fa178a92e
Instruction Fuzzy Hash: 5D92E671E00219CFDB14CFA8D8517AEBBB2FF89310F298169E455AB391D735AD42CB90

Function 00B7F85D Relevance: 11.6, Strings: 8, Instructions: 1556COMMON

Download Yara Rule

Strings

Aww, xrefs: 00B7F9B1
~c, xrefs: 00B7F9D7
W>}0, xrefs: 00B7FF32
s*u_, xrefs: 00B8046A
eWg_, xrefs: 00B80A0D
L,z{, xrefs: 00B80AAD
lZw, xrefs: 00B7FCF3
\KoU, xrefs: 00B80846

Memory Dump Source

Source File: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: Aww$L,z{$W>}0$\KoU$eWg_$lZw$s*u_$~c
API String ID: 0-1893117356
Opcode ID: c0f8e457d042dc656046dc97daf33cf755dd7e6783e3787279ff858534a77be9
Instruction ID: 4115ac5cb243b80e2ff262489c245b392cdca806acf351984a85e3b7e7862af0
Opcode Fuzzy Hash: c0f8e457d042dc656046dc97daf33cf755dd7e6783e3787279ff858534a77be9
Instruction Fuzzy Hash: B2A206F36082049FE3046E2DEC8577ABBE9EF94720F1A453DEAC4C3744EA3598158697

Function 009D098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

gce/, xrefs: 009D1073
,#15, xrefs: 009D0F94
cah`, xrefs: 009D107E
&> &, xrefs: 009D0F89
qrqp, xrefs: 009D1089
9.5^, xrefs: 009D0F9F
{, xrefs: 009D1502
%*+(, xrefs: 009D0A77, 009D0A86

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: e335f1e25833b1adda56068bbdf5b11f6991838cd2103ecaab0d93a40bb29115
Instruction ID: b5ff0c7d32789252ddb84bd72a415ae7c6b07ee41093ddc32485210d3fce9da6
Opcode Fuzzy Hash: e335f1e25833b1adda56068bbdf5b11f6991838cd2103ecaab0d93a40bb29115
Instruction Fuzzy Hash: B06298B16483858BD730CF14D895BABBBE1FBD6314F04892EE49A8B781E3759841CB53

Function 009B1000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

0123456789ABCDEFXP, xrefs: 009B157D, 009B15EB
-, xrefs: 009B21ED
gfff, xrefs: 009B2226
@, xrefs: 009B2C40
gfff, xrefs: 009B2297
gfff, xrefs: 009B22E1
0123456789abcdefxp, xrefs: 009B1587, 009B15F8

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 981d7f776e1ab5dfe332bdf0ac90106bee2a9a4743a5a19823e118f874d14f48
Instruction ID: fdc3d6f1fed3a0bb0c0400826fb6676c764fb58886af213010d2dcdbc81dabe1
Opcode Fuzzy Hash: 981d7f776e1ab5dfe332bdf0ac90106bee2a9a4743a5a19823e118f874d14f48
Instruction Fuzzy Hash: 46D202716083518FC718CF28C5943AABBE6AFD9324F18CA2DE499CB391D774D945CB82

Function 00B82C4F Relevance: 9.1, Strings: 6, Instructions: 1584COMMON

Download Yara Rule

Strings

Efy!, xrefs: 00B82EC6
^U]o, xrefs: 00B836A0
t;~, xrefs: 00B83C91
b|=, xrefs: 00B830A9
tWg_, xrefs: 00B83EA2
3?, xrefs: 00B83A24

Memory Dump Source

Source File: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: Efy!$^U]o$b|=$tWg_$t;~$3?
API String ID: 0-2987487168
Opcode ID: c556766c40154cb01e8a031e1e2553bd2c8f77bf9b4d0088b5d7e452b44590ad
Instruction ID: 187e69fc9e406024247dd0b1355139ec1ae19373fd55b29a4433fdee9fd468ec
Opcode Fuzzy Hash: c556766c40154cb01e8a031e1e2553bd2c8f77bf9b4d0088b5d7e452b44590ad
Instruction Fuzzy Hash: 00B204F360C200AFE3086E29EC9567AFBE9EF94320F16493DE6C5C7744EA3558418697

Function 00B866A8 Relevance: 8.7, Strings: 6, Instructions: 1238COMMON

Download Yara Rule

Strings

7}, xrefs: 00B86EBF
akz, xrefs: 00B8704A
XPt, xrefs: 00B8687F
W7~, xrefs: 00B873CE
3kwo, xrefs: 00B8675C
7!, xrefs: 00B86EC4

Memory Dump Source

Source File: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: 3kwo$7!$7}$W7~$XPt$akz
API String ID: 0-1868850053
Opcode ID: 4e590523230c59b0bed8b94896476015425c614c7f32f3ac6ec57b8f6d68de6e
Instruction ID: 2ebc38a183858dee89c6a07fd9998c9b4890492d08241f4c2e582e1f925dd9ff
Opcode Fuzzy Hash: 4e590523230c59b0bed8b94896476015425c614c7f32f3ac6ec57b8f6d68de6e
Instruction Fuzzy Hash: 588229F3A0C2009FE304AE2DEC8567AB7D9EFD4720F1A853DEAC4C7744E97598118696

Function 00B8B27D Relevance: 7.8, Strings: 5, Instructions: 1554COMMON

Download Yara Rule

Strings

w}?, xrefs: 00B8B861
A)e:, xrefs: 00B8B940
X@:], xrefs: 00B8BEAB
nMsw, xrefs: 00B8BDCE
A)e:, xrefs: 00B8B94D

Memory Dump Source

Source File: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: A)e:$A)e:$X@:]$nMsw$w}?
API String ID: 0-3626384455
Opcode ID: e5d7460e243689a6648a612003f00417418012d24733fcc2287cba009f15799c
Instruction ID: 727bcbe19106437a89eecc34339f95b269b5389ebbfb13116202f4e22ce30dcd
Opcode Fuzzy Hash: e5d7460e243689a6648a612003f00417418012d24733fcc2287cba009f15799c
Instruction Fuzzy Hash: 33B2F8F350C600AFE304AE2DEC8567AFBE5EF94720F16892DE6C4C7744EA3598418697

Function 009B12F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

@, xrefs: 009B3531
0, xrefs: 009B1DC1
i, xrefs: 009B28EA
0, xrefs: 009B1E88
0, xrefs: 009B243E

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: ac46f1ce14f559187e7cf66db58f9c70d31f2515ae63ab8c6f098b491a787f5e
Instruction ID: acc20cbeac0b59d5a95c4e2a0760f97be3b33902175a46ccdae8136bc950586f
Opcode Fuzzy Hash: ac46f1ce14f559187e7cf66db58f9c70d31f2515ae63ab8c6f098b491a787f5e
Instruction Fuzzy Hash: 6262E37160C3818BC319CF28C6947AABBE5EFD5324F188E2DE8D987291D774D949CB42

Function 009B164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

0123456789ABCDEFXP, xrefs: 009B164F
+, xrefs: 009B1573
gfff, xrefs: 009B1F57
0123456789abcdefxp, xrefs: 009B1659
gfff, xrefs: 009B1F3C

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: 6a8d6dc0b7159b929bcce5bb8d28e8957660f96821bcec3971eb99918fd0f56a
Instruction ID: 57806616783afe79e04799070c8a82ff77090ef7a5b19748de5e68ab54b87f24
Opcode Fuzzy Hash: 6a8d6dc0b7159b929bcce5bb8d28e8957660f96821bcec3971eb99918fd0f56a
Instruction Fuzzy Hash: 26F1C03160C3818FC719CF28C5943AAFBE2ABD9314F188A6DE4D987356D774D948CB92

Function 00B78BD2 Relevance: 6.7, Strings: 4, Instructions: 1658COMMON

Download Yara Rule

Strings

&#=o, xrefs: 00B79A55
Q'F, xrefs: 00B795E3
Mo_, xrefs: 00B79BC0
o', xrefs: 00B78D30

Memory Dump Source

Source File: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: &#=o$Q'F$ o'$Mo_
API String ID: 0-498967810
Opcode ID: f0466d3b9304b5f2cbdb59d3b16a792cb0c71de65c6e61c51b246d8906b3a9e5
Instruction ID: ba7029a245a477a23f6ba2171153d9402f2fd46e84fb94808bc9b84e17a66494
Opcode Fuzzy Hash: f0466d3b9304b5f2cbdb59d3b16a792cb0c71de65c6e61c51b246d8906b3a9e5
Instruction Fuzzy Hash: 49B248F3A0C2049FE3046E2DEC8567ABBE9EFD4720F1A463EE6C4C7744E93558058696

Function 009B13A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

0123456789ABCDEFXP, xrefs: 009B13A3
-, xrefs: 009B1F23
gfff, xrefs: 009B1F57
0123456789abcdefxp, xrefs: 009B13AD
gfff, xrefs: 009B1F3C

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 47e63d29d033504f7f3047523644aa59ce916597e3e1ab0bd297e8800abc24d2
Instruction ID: a4f6dd9430f351000c69c5c19627225b360e4303781aa296a10dd13b9d10edd3
Opcode Fuzzy Hash: 47e63d29d033504f7f3047523644aa59ce916597e3e1ab0bd297e8800abc24d2
Instruction Fuzzy Hash: E9D1BE3160C3828FC719CF29C5942AAFBE2AFD9314F08CA6DE4D987356D634D949CB52

Function 00B7DD73 Relevance: 6.6, Strings: 4, Instructions: 1630COMMON

Download Yara Rule

Strings

7j~w, xrefs: 00B7F043
S`l, xrefs: 00B7E883
=Y, xrefs: 00B7DE3B
0W{, xrefs: 00B7E862

Memory Dump Source

Source File: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: 0W{$7j~w$=Y$S`l
API String ID: 0-1150561618
Opcode ID: 53951822e6de4366bf3a0f73bc0b0ee44c5ff8d0e3d3a5a4d72e8f55f50a2e60
Instruction ID: af9b25ffcf6812e1f8e6e54977dffdcde709da201c562c42a215a20bac308c4a
Opcode Fuzzy Hash: 53951822e6de4366bf3a0f73bc0b0ee44c5ff8d0e3d3a5a4d72e8f55f50a2e60
Instruction Fuzzy Hash: EEB21BF361C2049FE308AE2DEC8567AB7E9EF94320F1A453DE6C5C3744EA3598058697

Function 009DFD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

NA_I, xrefs: 009E036D
:, xrefs: 009E0087
m1s3, xrefs: 009DFEC3, 009DFECB
uvw, xrefs: 009DFE95

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 2efe6627b4fd0a4ac93635d915ef80dfbc923a708bba7b1c9bb4243b311154cf
Instruction ID: 555ca54a4c89cb8c471761744c4077eeeb1b7aada16b6a9e206792446b8d66a7
Opcode Fuzzy Hash: 2efe6627b4fd0a4ac93635d915ef80dfbc923a708bba7b1c9bb4243b311154cf
Instruction Fuzzy Hash: 6732BAB0508385DFD302DF69D880B2ABBE5AB8A350F144D2CF5D58B2A2D375D946CF52

Function 009C3BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

p, xrefs: 009C3C80
ss, xrefs: 009C3C79
%*+(, xrefs: 009C3EC4
;z, xrefs: 009C3C87

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 91b7d1148f16daa4d5ce56fb8d4908cdbebda41d7aec4875e2b2e667a1fefab0
Instruction ID: 87f5595a9898b9e03e84f332d9c591e3d38b4a0734d1c873c856aca4c9c260b1
Opcode Fuzzy Hash: 91b7d1148f16daa4d5ce56fb8d4908cdbebda41d7aec4875e2b2e667a1fefab0
Instruction Fuzzy Hash: 5C025CB4810B009FD760DF28D986B56BFF5FB05300F50895DE89A8B696E370E419CFA2

Function 00B7C21E Relevance: 5.4, Strings: 3, Instructions: 1658COMMON

Download Yara Rule

Strings

z_wf, xrefs: 00B7C3A2
Pj3, xrefs: 00B7C7EC
?, xrefs: 00B7D58F

Memory Dump Source

Source File: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: Pj3$z_wf$ ?
API String ID: 0-3441300295
Opcode ID: 210be96f2a26971b2e6b4d4af677bbf60d1269f95fd4d5b9834541de9c2b4379
Instruction ID: cd2e0004e0cc4acee55455fa32acb32f9d5fed77e6e0fded015b4fa35ca7327b
Opcode Fuzzy Hash: 210be96f2a26971b2e6b4d4af677bbf60d1269f95fd4d5b9834541de9c2b4379
Instruction Fuzzy Hash: 7FB229F36082049FE304AE2DDC8567AFBE9EF94720F1A853DEAC4C7744EA3558058697

Function 009D2260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

sj, xrefs: 009D2327
lc, xrefs: 009D2507
hu, xrefs: 009D232F
a|, xrefs: 009D2317

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: ed77d5499154e15b1ad3452d3097c95e02c3d7551da87a7d4c0bbf1c94f08aff
Instruction ID: 63926f4105229f92cedaba7ccd11a627736cb64d9937f2780887c29549469dd3
Opcode Fuzzy Hash: ed77d5499154e15b1ad3452d3097c95e02c3d7551da87a7d4c0bbf1c94f08aff
Instruction Fuzzy Hash: 41A179B44483418BC720DF18C891A2BB7F4FFA5754F588A0DE8D99B3A1E339D941CB96

Function 00B87C3E Relevance: 5.4, Strings: 3, Instructions: 1602COMMON

Download Yara Rule

Strings

5pUl, xrefs: 00B88218
1pUl, xrefs: 00B88213
4>w/, xrefs: 00B88917

Memory Dump Source

Source File: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: 1pUl$4>w/$5pUl
API String ID: 0-4245999226
Opcode ID: 39602d200c791f5ff77d777cbd1bbb4d652a6780d4d91a6f1ef534105b95bc85
Instruction ID: 13e09821cb35752c141ec51b37d028d093c9a0c6d0c588b1d3da14c4425463c3
Opcode Fuzzy Hash: 39602d200c791f5ff77d777cbd1bbb4d652a6780d4d91a6f1ef534105b95bc85
Instruction Fuzzy Hash: C4B2F5F3A082109FD304AE2DDC8577ABBE9EF94720F1A493DEAC4C7744EA3558058796

Function 009DD7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

KV, xrefs: 009DD97D
#', xrefs: 009DD9EA
T>, xrefs: 009DD984
CV, xrefs: 009DD98B

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: 68563e3eb5b05fb6c3d70c10811f776b663bb2e85fecf8bcc85ebbb4547fc0cd
Instruction ID: 2ed8b4280771859cced35b0028f24c935e22303571b81a1a831ebf61d80cf51a
Opcode Fuzzy Hash: 68563e3eb5b05fb6c3d70c10811f776b663bb2e85fecf8bcc85ebbb4547fc0cd
Instruction Fuzzy Hash: BA8157B48017459BCB20DFA5D28516EBFB1FF12300F604A0DE4866BB55C334AA55CFE2

Function 009DAC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

(g6e, xrefs: 009DACA1
lk, xrefs: 009DACBC
,{*y, xrefs: 009DAD07, 009DAD13
4c2a, xrefs: 009DACA9

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: 096f4fced90ec28bde5b7d03acd262c012ca17bd5e5d9272729c9d5c7030376e
Instruction ID: 7fb5ec93c43be76ded3f1b12d80c3f5fa16bd6c9b5e05a89ac7f5c887140185a
Opcode Fuzzy Hash: 096f4fced90ec28bde5b7d03acd262c012ca17bd5e5d9272729c9d5c7030376e
Instruction Fuzzy Hash: 794163B4408386CBD7209F20D900BABB7F4FF86345F54995EE6C897260DB32D946CB96

Function 009DC470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

~/i!, xrefs: 009DC537
%*+(, xrefs: 009DC9E4, 009DC9ED
%*+(, xrefs: 009DC8C3, 009DC8CB

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: 1ab261ab12773a337d76e5b0cffdaaccc99579441adb8798b5f0575f2737a807
Instruction ID: 3dcc9c37e3426fb0b772bb8f6a917ea85ba1d05c23eff963dc4c99533164702d
Opcode Fuzzy Hash: 1ab261ab12773a337d76e5b0cffdaaccc99579441adb8798b5f0575f2737a807
Instruction Fuzzy Hash: 20E185B5518349DFE320DF64D881B6ABBE9FB85340F48882DF68987251D736D812CF92

Function 009B8590 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

IEND, xrefs: 009B89F0
), xrefs: 009B860C
), xrefs: 009B8616

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 78867cf96f118895ffb97412420d4ac7c6f08c49c7589883852998ff4bcd2715
Instruction ID: 955fdf2b822543b059f4cbc40dd9fe5788595778223b7340b7502871e64672a6
Opcode Fuzzy Hash: 78867cf96f118895ffb97412420d4ac7c6f08c49c7589883852998ff4bcd2715
Instruction Fuzzy Hash: E6E1D3B1A087069FE310CF28C9457ABBBE8BB98324F14492DF59597381DB75E914CBC2

Function 009F4040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009F40A4, 009F40AD
f, xrefs: 009F420C

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 335c30ce2f69dd7557819ebbbf6f6a1b3e31024a3588daccef94ce2c86ff6382
Instruction ID: 8718eab3af0ec2eebc4bc1288d8c7348455a2557c40fb0ff21c94d4237cb66c8
Opcode Fuzzy Hash: 335c30ce2f69dd7557819ebbbf6f6a1b3e31024a3588daccef94ce2c86ff6382
Instruction Fuzzy Hash: FE128A716083459FC714CF18C880B2FBBE6BBD9314F188A2CF6959B291D735E945CB92

Function 009EF620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

hi, xrefs: 009EF6E6
dg, xrefs: 009EF7F5

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: c0ded4b93c77fe87362dd12408d68cd416a32eb2823ab59ec20813d3b30ec027
Instruction ID: 227173dcccb2ba0d5ef6f3c70c443bf7110a91fe30ce6ceb123a4479278aee29
Opcode Fuzzy Hash: c0ded4b93c77fe87362dd12408d68cd416a32eb2823ab59ec20813d3b30ec027
Instruction Fuzzy Hash: 18F19571618342EFE704CF25C895B2ABBF5FB86384F14992DF1858B2A1C735D946CB12

Function 009B35B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

Inf, xrefs: 009B3607
NaN, xrefs: 009B360E

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 19e3cbec1dbbb7d088eb1db11f77c9c2a8a565ac8103a70d9bb36097a0fe0a6c
Instruction ID: b52a39a7a4f5b4134f3bbcd35cc36e0fd74edfcf6f0126d814a570e1adfb0669
Opcode Fuzzy Hash: 19e3cbec1dbbb7d088eb1db11f77c9c2a8a565ac8103a70d9bb36097a0fe0a6c
Instruction Fuzzy Hash: 9FD1E5B1A183119BC704CF29C98065EB7E5EBC8760F25CA2DF999973A0E675DD048B82

Function 00ADB722 Relevance: 2.7, Strings: 2, Instructions: 240COMMON

Download Yara Rule

Strings

6W{, xrefs: 00ADB8F4
!fj, xrefs: 00ADB731

Memory Dump Source

Source File: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: !fj$6W{
API String ID: 0-1771172355
Opcode ID: e5e5016a56c9479d57a5f3c4c75fccbcf2f5ad0e59499d2aff4a59e9156c81fc
Instruction ID: 5cfb64a61aea6dca92a350cdfc7b7d7cb5300eca93ec407c77a280556fadc6a0
Opcode Fuzzy Hash: e5e5016a56c9479d57a5f3c4c75fccbcf2f5ad0e59499d2aff4a59e9156c81fc
Instruction Fuzzy Hash: 94715CB3F182105BE340AD3CDC85767BBD6DBD0720F168A3DEAC8C7784E97999058285

Function 00A3EA2A Relevance: 2.7, Strings: 2, Instructions: 240COMMON

Download Yara Rule

Strings

#A[?, xrefs: 00A3EBCA
kU|., xrefs: 00A3EC28

Memory Dump Source

Source File: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: #A[?$kU|.
API String ID: 0-2180075046
Opcode ID: 1b5ee5a56d165b6a1c183c18f4682a035c5c0d96e9afb0a71c4f8941e5265546
Instruction ID: 10f81e58a51e3630fc0d9f3599c8560f7c3e23f7c77e0adb0a7e9c75ff6a3855
Opcode Fuzzy Hash: 1b5ee5a56d165b6a1c183c18f4682a035c5c0d96e9afb0a71c4f8941e5265546
Instruction Fuzzy Hash: A47160F3A082105FE3085E3DED8576AB7D6EB94324F1A453CDBD5C3380E97998058396

Function 009CFFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

Ye[g, xrefs: 009D00F6
BaBc, xrefs: 009D0197

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: dda9654d314a6d1d5410945cc4b557cd17453bc7684436e135a904ac4d2828f2
Instruction ID: 0d313acd096d27bc336bc68b7b08a085c381d1e0abc0d1dddba8ccfb11b86553
Opcode Fuzzy Hash: dda9654d314a6d1d5410945cc4b557cd17453bc7684436e135a904ac4d2828f2
Instruction Fuzzy Hash: 3B51A7B16483828AD731CF14C881BABB7E4FFD6320F08891EE49A9B751E3749940CB57

Function 00B6E718 Relevance: 2.7, Strings: 2, Instructions: 170COMMON

Download Yara Rule

Strings

<Xw<, xrefs: 00B6E83D
--y, xrefs: 00B6E73E

Memory Dump Source

Source File: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: <Xw<$--y
API String ID: 0-1033747771
Opcode ID: dcc6b4658271660d5b83c1a755f0ce1c29bb1dc8bc6740aaf092a34e9cb132a4
Instruction ID: 1d104680fa6f2980df8fb1c150b9a5325616bd34aeda1b3f4aaee3ec434f81ae
Opcode Fuzzy Hash: dcc6b4658271660d5b83c1a755f0ce1c29bb1dc8bc6740aaf092a34e9cb132a4
Instruction Fuzzy Hash: 33416DF3A193085FE314A92DEC84777FBD9DBD4220F29823ED985D3785F97168058292

Function 00B84F20 Relevance: 2.2, Strings: 1, Instructions: 988COMMON

Download Yara Rule

Strings

!}{, xrefs: 00B85AEE

Memory Dump Source

Source File: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: !}{
API String ID: 0-2865939276
Opcode ID: e3e734ea4f3eceea6e48ae724fe7138cafac3286181cd29044dee1ffbb96764c
Instruction ID: 3f2ff103d0bb9f1879ec1c97df34072d2d1ab80793ab39558f515cfdda14e2ab
Opcode Fuzzy Hash: e3e734ea4f3eceea6e48ae724fe7138cafac3286181cd29044dee1ffbb96764c
Instruction Fuzzy Hash: 0A628CF3A08204AFE3046E3DEC8577ABBD9EB94360F1A463EEAC4D3744E57559008696

Function 00B7B116 Relevance: 2.0, Strings: 1, Instructions: 756COMMON

Download Yara Rule

Strings

fDr?, xrefs: 00B7B71E

Memory Dump Source

Source File: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: fDr?
API String ID: 0-3824510102
Opcode ID: f47ca30d0de63077d7143b8610a9fab139f910c431a6eb063223291e8157f2ec
Instruction ID: 35c092f1dfd04c934b11462568bdce3f7d1bd33cdb34529fb4668b7c03a77ba3
Opcode Fuzzy Hash: f47ca30d0de63077d7143b8610a9fab139f910c431a6eb063223291e8157f2ec
Instruction Fuzzy Hash: 2732E4F360C2149FE304AE29DC8577ABBE5EF54320F0A4A3DEBD487744EA3598148697

Function 009B5160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 009B54C8

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: fe306e135ad77d86a9e6ab119d9db27f76f6e323d47826ac63ecf04248f265af
Instruction ID: 07f847cb30257b5f98826c8bafe45872d0ee304e042d77823581501e7eedf803
Opcode Fuzzy Hash: fe306e135ad77d86a9e6ab119d9db27f76f6e323d47826ac63ecf04248f265af
Instruction Fuzzy Hash: 7F221AB2608B42CBE7258E18D6803A7BBE7AFE0324F1E856DD8594B351EBB5DC05C741

Function 009E12D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 009E15D1

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 5da166eb4f803471c6f65eef402d8dfd1fe2a1f3b64df960744b5a7c283e2c8d
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: 19F12771A083814FC726CF26C49076BBBEAAFC5354F18C96DE89A87382D634DD45C792

Function 009DAE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009DB2D3, 009DB2DB

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 89562c4f968ab314a5f98ccd22361a1e06b9a6a4853942670c817d13af662e18
Instruction ID: d8eab4dfad1bb5410a1488bcc31f036ea318a0a4e088d385e275ba3a8d84bb4c
Opcode Fuzzy Hash: 89562c4f968ab314a5f98ccd22361a1e06b9a6a4853942670c817d13af662e18
Instruction Fuzzy Hash: 76E1A67154830ACBC724DF28C89066FB3E6FF98781F65891DE4C587324E334A95ADB82

Function 009C6EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009C6EF3

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 38f501bf28a1d71d8aa32f00a4d0bd50be052ff8f9ed95b261340a7788320ab3
Instruction ID: 5fdd36dfc287a7ef0425ffa8bfa98eba513980af7790c7f48d65ffcc904f24fd
Opcode Fuzzy Hash: 38f501bf28a1d71d8aa32f00a4d0bd50be052ff8f9ed95b261340a7788320ab3
Instruction Fuzzy Hash: 31F1AEB5A14B05CFC724DF24D991A26B3F6FF88314B148A2DE59787A91EB30F815CB42

Function 009D7E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009D8263, 009D826B

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 6c0c29563435cfc6240ab445361bea654fbd5f5b5e5f46b292bf16413e180005
Instruction ID: 9584d426f4372be2ded248ee538a93e22446405438e0786ad2af0359e8a785b1
Opcode Fuzzy Hash: 6c0c29563435cfc6240ab445361bea654fbd5f5b5e5f46b292bf16413e180005
Instruction Fuzzy Hash: CCC1B0B1548200ABD720EF14C882B2BB7F9EF95754F488819F8C597352E735ED15CBA2

Function 009D8D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009D9233, 009D923B

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: a1de7fab9c4d44e1d4844558574907f3131e879cc6dcf8f2e36627a22ea68ad8
Instruction ID: bd22b7f88374e236fd1778eaf73f9d519abeef11fe4245ae3108a3f76ef822ef
Opcode Fuzzy Hash: a1de7fab9c4d44e1d4844558574907f3131e879cc6dcf8f2e36627a22ea68ad8
Instruction Fuzzy Hash: 8DD1AB70618306DFD704DFA8D890B2AB7E5FF89314F49886DE88687391DB34E952CB61

Function 009F7FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 009F8167

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 8c8035ade3851258b08c4c9ea83a8441853e95d89d869ccdac48be5dc4268020
Instruction ID: 11dbe5e4918411f75ada5424e21457390bc6c9671427d6ae8c7a0c42539b3630
Opcode Fuzzy Hash: 8c8035ade3851258b08c4c9ea83a8441853e95d89d869ccdac48be5dc4268020
Instruction Fuzzy Hash: 0ED105729083694FC725CE18D89072FB6E1EB84758F158A2CEAB5AB394CB71DC06C7C1

Function 009DCCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009DCDC3, 009DCDCB

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: df2116037c3fb7d2447eb80d2c0ad9f48c500f4e796088b7cdaa3984012e8471
Instruction ID: 9574619a7008beddaffa30137eb64b2857e451c60b208a0b482bc2b4b133547a
Opcode Fuzzy Hash: df2116037c3fb7d2447eb80d2c0ad9f48c500f4e796088b7cdaa3984012e8471
Instruction Fuzzy Hash: A6B103B09493069BD714DF58D880B2BBBE6EF85340F14882EE5C59B391E335EC55CBA2

Function 009BA850 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 009BA9C3

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: d28c2da1bf7b93f936b26f85032adb6244af7a485228254dcf8afebd23c84595
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: 8FB138702083819FD324CF18C98065BBBE1AFA9714F448E2DF5D997742D671EA18CB67

Function 009EFC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009EFCA4, 009EFCAD

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 99b474c3b5231e69ed4a2fd90cca7a45c0c76ca301916aa025ec8467a0d97135
Instruction ID: d5eeeea067a71412c4405fd831ce3766e080c19730480cd1dad6d4a64ef9c851
Opcode Fuzzy Hash: 99b474c3b5231e69ed4a2fd90cca7a45c0c76ca301916aa025ec8467a0d97135
Instruction Fuzzy Hash: 1B81CC70508349ABD711DF69DC94B2ABBE5FB89741F14882DF28487291D734DC16CB62

Function 009CD457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009CD663, 009CD66B

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: f7ec125623ef06b73e15b225a797c2c4910992c6dd6bce9688317027bea1e060
Instruction ID: 2deea6f08a82d07082da4716732f6690eb3361758d7b59b9fbb61048a09feed3
Opcode Fuzzy Hash: f7ec125623ef06b73e15b225a797c2c4910992c6dd6bce9688317027bea1e060
Instruction Fuzzy Hash: C961BDB1909208DBD710EF58DC82F3AB3A4FF95354F08092DF9859B291E775E912CB92

Function 009F4A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009F4C33, 009F4C3B

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 1db1566ff48ccfd902d6e2f3c2d4ba9b8ee1e302bc813cec6c6689d9bcdf5036
Instruction ID: b7fa99f4dc9a694cd8bc46aef1da9fcfd3d996be347d2a5ee880a52c710f0b90
Opcode Fuzzy Hash: 1db1566ff48ccfd902d6e2f3c2d4ba9b8ee1e302bc813cec6c6689d9bcdf5036
Instruction Fuzzy Hash: B661AC71A083099BD711DF69C880B3BBBEAEB84315F18892CE6D587292D731EC51CB52

Function 00B063F8 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

'&}, xrefs: 00B064D7

Memory Dump Source

Source File: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: '&}
API String ID: 0-3660282814
Opcode ID: 6db00d01d622ad584e1f8703b4dd5d78e99bdce7d7eeb438247256fa89bfbd0e
Instruction ID: 5b9fda1e0c7ab7c517e583ff3da270c35d22d5658c88c13849ea28e73c9be519
Opcode Fuzzy Hash: 6db00d01d622ad584e1f8703b4dd5d78e99bdce7d7eeb438247256fa89bfbd0e
Instruction Fuzzy Hash: D761C4B3E082149FE310AE29DC8476AF7E6EF94720F1B893DDAC897740D6791C418786

Function 00B497C7 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

=]~=, xrefs: 00B4987E

Memory Dump Source

Source File: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: =]~=
API String ID: 0-2931120874
Opcode ID: 35998305a3cca41d3d1a5de95d2bdc80a6e98f236d56cd8d4be148c19d5cc2d0
Instruction ID: 8050eb5e357f112115ca80783cf53b05d5f4daea908059adaa637053be9da30e
Opcode Fuzzy Hash: 35998305a3cca41d3d1a5de95d2bdc80a6e98f236d56cd8d4be148c19d5cc2d0
Instruction Fuzzy Hash: 385169F3A185049BF304AE3DDC4576ABBD7EBD4310F1A8A3DE5C9C7784E97A94018642

Function 00A2B2B4 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

GQs, xrefs: 00A2B498

Memory Dump Source

Source File: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: GQs
API String ID: 0-2123719996
Opcode ID: 9f22b01bbf009f60b3e0cdeabb257abb6e5bfb332b598488290d2c9bd3351709
Instruction ID: 1e4266b95f5584ce24a84f182c9b40a2d5c6a9e44ce635b273ae7773c73b3b1e
Opcode Fuzzy Hash: 9f22b01bbf009f60b3e0cdeabb257abb6e5bfb332b598488290d2c9bd3351709
Instruction Fuzzy Hash: C251E6F3A082109FE3106E2DDD4576AF7E5EFD4720F1B493DDAC897744EA3598018692

Function 009BE1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 009BE333

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 0bfc3425d7df4ff496dae6cffaa9539abab6cec1a5e30c5dc7146f5c43e78ba3
Instruction ID: 3de0676ff1022f4dcdebfe59be136039229578b994f3709e17c5b2f633340198
Opcode Fuzzy Hash: 0bfc3425d7df4ff496dae6cffaa9539abab6cec1a5e30c5dc7146f5c43e78ba3
Instruction Fuzzy Hash: 74512323A1D6904BD328993C4E553EA7ACB0FE2334B3DCB69E9F1CB3E5D55988009390

Function 009F3920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009F39E3, 009F39EB

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: b36a01be3ce3ee7e4e1154117e7a325c2885ea3d1d265b044ef2ff701e62791f
Instruction ID: 3f7c03eff97a0e845f054c739ef1bbc0a0c518bc8b66b9819a25207fc9423c67
Opcode Fuzzy Hash: b36a01be3ce3ee7e4e1154117e7a325c2885ea3d1d265b044ef2ff701e62791f
Instruction Fuzzy Hash: C651BE34619208DBCB24DF2AD880A3ABBE9EF85744F14C81CE6C687251D379DE51DB62

Function 00B11269 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

]zw;, xrefs: 00B11286

Memory Dump Source

Source File: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: ]zw;
API String ID: 0-2419123184
Opcode ID: 648839ca55c9cd38b5f1cdb635996a82e99ba30ae171b52c77304135cc381328
Instruction ID: 6a1e5a6acb7760bc9a3de428f79e6ff53c04e6ca9602bd626d63c3335a9d96f4
Opcode Fuzzy Hash: 648839ca55c9cd38b5f1cdb635996a82e99ba30ae171b52c77304135cc381328
Instruction Fuzzy Hash: 4A4128F36183084BE344BD3DDD8977ABBD6DB80310F26863D9B8187B48ED7559088286

Function 009C1BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 009C1C3E

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: 4fbff134b386c40f241c01cb883338b8853f903419070e2abe9eaf5ca10f1c5c
Instruction ID: 36cd44f2dd331d7a27c365e676ae373b32eae2d1e10a07f86cbed8af95d35d16
Opcode Fuzzy Hash: 4fbff134b386c40f241c01cb883338b8853f903419070e2abe9eaf5ca10f1c5c
Instruction Fuzzy Hash: 644141B44083849BC7149F64C894A2FBBF4BF8A354F04991CF5C69B292D736CA06CB5B

Function 009EFF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009F0033, 009F003B

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c30501990b89b94e89707dd353c468817a72711fd36208dcf6cc202e05697fbb
Instruction ID: 7a33f199310ddb6b4afa9fcf8a072365aba475987c47482bc4caf2c2474352c0
Opcode Fuzzy Hash: c30501990b89b94e89707dd353c468817a72711fd36208dcf6cc202e05697fbb
Instruction Fuzzy Hash: D631B3B1904309ABD710EA64DC81B3BB7EDEBC5744F584828FA85D7253E621DC15CB62

Function 009DE40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 009DE6A2

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 6375cc92efe6091ca2d5ce9687399992e316a0a423daf6d7a53be0ffa3688cb6
Instruction ID: 237251e05b3b68a0774730afd8d19fedb118e5a97bbc8c71e57633cdf64b4a58
Opcode Fuzzy Hash: 6375cc92efe6091ca2d5ce9687399992e316a0a423daf6d7a53be0ffa3688cb6
Instruction Fuzzy Hash: 8931F6B5900209CFCB20DF95E9806EFB7B4FB4A345F54482DE446AB301D335AD06CBA2

Function 009C6F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009C703B

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 96cf657dc0d7baa5c76f7accf35adfc90dca38aa38ddea3b041b014dd6b22daf
Instruction ID: 0c744eb1b62cb4c81759d1165fe4a50c7a71341873febc232f03d5cab9d93cfa
Opcode Fuzzy Hash: 96cf657dc0d7baa5c76f7accf35adfc90dca38aa38ddea3b041b014dd6b22daf
Instruction Fuzzy Hash: 88413271A04B049BD734CBA5C995F27BBF6FB49701F14881CE68A9BAA1E331E8018F11

Function 009DE66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 009DE6A2

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: a9086cfd6060fbb4d59b0e0564f2227788815fb73cbf0b190d331f5daf97ada4
Instruction ID: dfb113d6be83ba6ee0a67e432afc522ec619485322935e97aac2c7e6c84b790f
Opcode Fuzzy Hash: a9086cfd6060fbb4d59b0e0564f2227788815fb73cbf0b190d331f5daf97ada4
Instruction Fuzzy Hash: F221F4B1900308CFC720DF95D9806AFBBB5FB4A784F14481DE446AB301C335AD02CBA1

Function 009F9CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 009F9D30

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 1e57bf011a5322b73775af27277b2740897971b081da2dfc524ababd2c74c980
Instruction ID: 16029a01d29f0e53210a4bfdcd0c18dee0fb71170b60296f5e0dd68666e77743
Opcode Fuzzy Hash: 1e57bf011a5322b73775af27277b2740897971b081da2dfc524ababd2c74c980
Instruction Fuzzy Hash: 563149709093089BD714EF15D880A2BFBF9EF9A314F24892CF6C997291D335D905CB66

Function 009C4E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31501b90735b51863657ae633ca28320b8e526f38e1e76b23ec4a33bf3401a0c
Instruction ID: c29141f47d2d8cdea4950006ede82a399fdefb77f9044504a132faf53dc5ddc4
Opcode Fuzzy Hash: 31501b90735b51863657ae633ca28320b8e526f38e1e76b23ec4a33bf3401a0c
Instruction Fuzzy Hash: 59627AB0A00B418FD725CF24C990B27B7F6AF49710F55892CD49B8BA92E774F844CB92

Function 009BBEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 4ec10cd9ac037a061178c4d9751ebee0aa48930ed4f52a5024f3da4fe178be51
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: 80521971A087128BC7259F1CD5802FAF3E5FFC5329F294A2DD9D693290E734A851CB86

Function 009F8652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ff48288675870cfed34451c115b3b175c628d792a41243123fec7845d56f62
Instruction ID: ef726800b397ac9c49f2889e8de9e89c5502e8d88f0cbc5c3164dcd867bd4d71
Opcode Fuzzy Hash: 55ff48288675870cfed34451c115b3b175c628d792a41243123fec7845d56f62
Instruction Fuzzy Hash: 7A22CC75608349CFC704EFA8E89062AB7E1FF8D315F09896DE68987361D735D852CB42

Function 009F86F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d50ab82cfa7b4da735324ade7a393117eaf7b1e6855068d275ede8e6126ce1
Instruction ID: 16b603b036006cb89ad80604ebd02ad0299671740e5bafe336a7212f04ca238a
Opcode Fuzzy Hash: 73d50ab82cfa7b4da735324ade7a393117eaf7b1e6855068d275ede8e6126ce1
Instruction Fuzzy Hash: 5822BC75608349DFC704EFA8E89062ABBF5FB8E305F09896DE68987351C735D852CB42

Function 009BB3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a93fc8e160984382c6c399af3717bb5a97568e91b1073ae4191f8ed4861c33
Instruction ID: 459820539c69a42a736da0e286a32016c33d9409e9f5937c512ff474fe65aecc
Opcode Fuzzy Hash: 49a93fc8e160984382c6c399af3717bb5a97568e91b1073ae4191f8ed4861c33
Instruction Fuzzy Hash: 6652A570908B848FE735CB24C5947E7BBE6AF91324F144C2DD5D606AC2C7F9A885CB51

Function 009B71F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8197cc44c3825847e7ae7da1f2b9ec3641d74ab1b4d91926a22ce9b94ec6fbc
Instruction ID: 8aca6d8497f1f66025daeacdb687f6e2d088f5a24bf185949499abec92925489
Opcode Fuzzy Hash: b8197cc44c3825847e7ae7da1f2b9ec3641d74ab1b4d91926a22ce9b94ec6fbc
Instruction Fuzzy Hash: 90529D3150C3458BCB15CF68C1906EAFBE1BFC8324F198A6DE89A5B351D778D949CB81

Function 009B8FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e60f31c02b5618f4a75400ea992a623415a199d7b63f0d2d3aad93117d7ba61a
Instruction ID: 5fdab6ee97480617d4df68e589de147bddef3db6a03d836c4b55948065883721
Opcode Fuzzy Hash: e60f31c02b5618f4a75400ea992a623415a199d7b63f0d2d3aad93117d7ba61a
Instruction Fuzzy Hash: A2428775628301DFD708CF28D8547AABBE1BF88314F09886CE9858B3A1D779D985DF42

Function 009B7BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f3375e04216c3a904daf6a2820e23a78aa371709e4911e1819f5c9fd0c7c332
Instruction ID: 40bb11fa94773d12658a75ffbf86a9ae62a1c7235604ed1282a115982ca8d8c8
Opcode Fuzzy Hash: 6f3375e04216c3a904daf6a2820e23a78aa371709e4911e1819f5c9fd0c7c332
Instruction Fuzzy Hash: DB323370519B118FC328CE69C6905A6FBF5BF85720B604A2ED6A787B90D736F845CB10

Function 009F89A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62397065dcedc165f13961e7b2ac2984cec77acc0fe8f6dbe3d73c5fa55645d7
Instruction ID: 11c85d1a0dea391ac13840d3da74b6f3cc6bac664758aacb043778ede0398051
Opcode Fuzzy Hash: 62397065dcedc165f13961e7b2ac2984cec77acc0fe8f6dbe3d73c5fa55645d7
Instruction Fuzzy Hash: A602AA75608345DFC704EF68E88062ABBE5FB8E305F09896DE6C987361C735D852CB92

Function 009F8A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514d62ecfbd47e9d833c29c12070845908338df27f176900aefe888d8e4bdfa0
Instruction ID: e501b7282d4d3196561b5b791a1b8b1cef7a5a06c51725be6e62a3a1edd2c7d8
Opcode Fuzzy Hash: 514d62ecfbd47e9d833c29c12070845908338df27f176900aefe888d8e4bdfa0
Instruction Fuzzy Hash: 35F1897460C349DFC704EF68D88062AFBE5FB8A305F09896DE6C987251D736D912CB92

Function 009F8C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c6ce7ca79bb8d96670c55feb57be50deb7b4486901fda62e5bd876e30a4805f
Instruction ID: 15d0c18f8302298f55a38e8ae260cbe6937a44c0d841e41c2253c430961d7edd
Opcode Fuzzy Hash: 0c6ce7ca79bb8d96670c55feb57be50deb7b4486901fda62e5bd876e30a4805f
Instruction Fuzzy Hash: 51E1CE71608345CFC704DF68D88066AB7E5FB8E315F09896CE6D987361D736D912CB82

Function 009BA300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: dd1191cc464440da3cfd8cd6b9cf58480eee63ee9127e27c9b78a2bf858f0d4e
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: 28F1CE766083418FD724CF29C9817ABFBE6AFD8310F08882DE4D987751E639E945CB52

Function 009F8E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90f68b33e7e0f7fd6507504e6256448d66b7a490a0cc1c335fbc915576a3739
Instruction ID: 78140bca3d7786e9755e5de669e9d13a45d295f371f74ce517d9893a8a395642
Opcode Fuzzy Hash: a90f68b33e7e0f7fd6507504e6256448d66b7a490a0cc1c335fbc915576a3739
Instruction Fuzzy Hash: 8CD1AB7460C385DFD704EF68D88062AFBE5FB8A305F09896CE6C587251D736D812CB92

Function 009C4487 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe26897737d0f2ce228f0869711e71d72881c33e835c7e1e37f1a887baa7a6b
Instruction ID: b186a1c74d8c988f61e365ba996e758c19a8d06b48e63c8eb862c8c30c677eab
Opcode Fuzzy Hash: 1fe26897737d0f2ce228f0869711e71d72881c33e835c7e1e37f1a887baa7a6b
Instruction Fuzzy Hash: 2FE10FB5A11B008FD325CF28D9A2B97BBE1FF46705F04882CE4AA8B752D735B814CB15

Function 009F6CBF Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c4b80a31069445e8a132f1d1d584db0bfd6bf42a9f6e04a54056ba48f297e73
Instruction ID: cb8125c2372fbff329131564adf763afba450d097e6968f5e54dde55d68c3da7
Opcode Fuzzy Hash: 8c4b80a31069445e8a132f1d1d584db0bfd6bf42a9f6e04a54056ba48f297e73
Instruction Fuzzy Hash: AFD10336A1C359CFCB10CF78D88052AB7E5BB8A314F098A6CE591C7391D330DA46CB91

Function 009F7AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c94ccf31f72e7f66cf7e3226f42167d55a092eed6acf110351a6bb1226e65d9
Instruction ID: 1aad4c9f19ac3f6a44fa267cbc1f78340e2a89058703311340701eb97bb58a84
Opcode Fuzzy Hash: 6c94ccf31f72e7f66cf7e3226f42167d55a092eed6acf110351a6bb1226e65d9
Instruction Fuzzy Hash: 75B12472A083584BE314DEA8CC41B7BFBE9ABC4314F08092DFA9997391E735DC058792

Function 009BAF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 47f6dcbc674b456898caab49b4d08bbb882516e87be88b944932ed9122fa4b2f
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: 67C15EB2A187418FC370CF68DC96BABB7E1BF85318F08492DD1D9C6242E778A155CB46

Function 009C6536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46df4a876f91a4d803a2738f91039061170f8055d46656af0d54c9f05e28ac2
Instruction ID: df1b3b15b366a4163b9cf69c92453b690914e79cdffd92c4cbb682d62d25c9c3
Opcode Fuzzy Hash: a46df4a876f91a4d803a2738f91039061170f8055d46656af0d54c9f05e28ac2
Instruction Fuzzy Hash: D4B101B4900B408FD325CF24CA91B67BBF5AF46704F14885CE8AA8BB52E775F805CB56

Function 009F7710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ab4f8feb287bddf2af75d96d47091c76666695cdb4af449234618fdd63045d20
Instruction ID: 142ee348cfcec4ebe0985eb52da3d16be12de1d8498b37de1b7bf529f4856753
Opcode Fuzzy Hash: ab4f8feb287bddf2af75d96d47091c76666695cdb4af449234618fdd63045d20
Instruction Fuzzy Hash: B9918C71A08309ABE720DBA4D880B7BFBE6EB85354F548C1CF69497351E730E950CB92

Function 009FA0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09faeba2bcbb351708fc3213ec252eceb20feeee5733558aff5541a839a4b7ca
Instruction ID: 457c1013ca96492e580c879a5348211358726335319f5ba85d0b96c214d41332
Opcode Fuzzy Hash: 09faeba2bcbb351708fc3213ec252eceb20feeee5733558aff5541a839a4b7ca
Instruction Fuzzy Hash: FF819F742087098FD724DF68C880A3BB7F9EF89750F55892CEA9987251E731EC11CB92

Function 00A265AA Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc79c800a9cf61479b09a9adbe08b5cc89510bf3b2a471c8028d497f82710783
Instruction ID: 108712563ee35723716d1ff25bd2652c0dbdcd8074fe1abdeb65766f95283997
Opcode Fuzzy Hash: fc79c800a9cf61479b09a9adbe08b5cc89510bf3b2a471c8028d497f82710783
Instruction Fuzzy Hash: 3D714AF3A093145BE310A97DEC89767BBD9DBD0721F1B413AE684C7B48E8B8980182D5

Function 009E64F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03047d73801fb3406a0b102297809ebdccf9011ff244620b5d0c320283053d86
Instruction ID: b54d03da668df70d7e2b2d1aefbe39235303114349abb87a9783d588915d0782
Opcode Fuzzy Hash: 03047d73801fb3406a0b102297809ebdccf9011ff244620b5d0c320283053d86
Instruction Fuzzy Hash: 9B710733B29AD04BC3159D3D4C463A5AA934BF6378B3DC779A8B4CB3E5D52A4C069380

Function 009D28E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c80945e9f0daea83cbbaf7e04b177bbe2cb0775d92aeea7949626b20919c47
Instruction ID: f983b79f7a4c8d427694ee00d72c70e7ec213a963f198c9e57e4827f79e457ad
Opcode Fuzzy Hash: f1c80945e9f0daea83cbbaf7e04b177bbe2cb0775d92aeea7949626b20919c47
Instruction Fuzzy Hash: 9F6177B44483809BD310AF18D851A2BBBF5FFA6750F08891EF4C59B361E37AD911CB66

Function 009D7C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb485fb83380a161d2f6d8ce6f23da406e7bf37302d6720b3dc0c7ba6dca65b8
Instruction ID: 9601171ea6f1e2733b37925d2649d4d79381126ed42305ce0483d1f0e2b054a1
Opcode Fuzzy Hash: eb485fb83380a161d2f6d8ce6f23da406e7bf37302d6720b3dc0c7ba6dca65b8
Instruction Fuzzy Hash: D451C0B16982049BDB209BA4CC82BB7B3B9EF85368F148959F9858B3D0F375D801C761

Function 00B4CEC9 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c98a9395ed5a36d83478d363e3588e2414d55a7a8b3ea959878cd9eb290f183b
Instruction ID: e3ee48ed12eb3477194bdc357c1a8fe223184a23334b99de037baa4ebc52960f
Opcode Fuzzy Hash: c98a9395ed5a36d83478d363e3588e2414d55a7a8b3ea959878cd9eb290f183b
Instruction Fuzzy Hash: 0C610CF3A1C2109BE314AE2DDC857ABBBD6DF84720F16863DEAD4C3784E53598058786

Function 00AAA20C Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45731207cac2a515b5a32bd8bcb639da389f4c286c02d06a35790317e14556e
Instruction ID: 8e809894fb4f5577067ecf56a25b7c9015b9f7eb379be8fdf3e5170a11391b08
Opcode Fuzzy Hash: b45731207cac2a515b5a32bd8bcb639da389f4c286c02d06a35790317e14556e
Instruction Fuzzy Hash: F76105F3E081105BE3185A28DC4577AB7D6EBD4320F2B463DEAD9E77C0E93A5C418686

Function 009E1860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: 64c1ece46151fbf1da879915db24ab3dc108ffbbd60c7aaba071965d24ccce59
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: F861E03160D3819BD716CE2AC58072FBBE6ABC9350F64C93DE4998B352D274DD819B41

Function 009E82D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f4a29c1c97e3434150b688ad938da36a288838042bf10a1be8f55811be5d49c
Instruction ID: 1c75b5f4930ea9069141de8fad949c0d7e0148feaf130b3fb2f357ccde7e4c09
Opcode Fuzzy Hash: 2f4a29c1c97e3434150b688ad938da36a288838042bf10a1be8f55811be5d49c
Instruction Fuzzy Hash: EC615723A1EAD18BC316457E1C453A76A835BD6330F3EC7A6A8B98B3F5DD6D4C019341

Function 00B6F9CC Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8765959b5266c00434434618c1fde73118bbd45ade99115448f233abc4e2b0f9
Instruction ID: 3e1476a8c1355e100ceb0c8d1eb8a4b8493cef083f457dddb6269cc70bd709c1
Opcode Fuzzy Hash: 8765959b5266c00434434618c1fde73118bbd45ade99115448f233abc4e2b0f9
Instruction Fuzzy Hash: BF618CB3F1122547F3544879DCA836265839BE5324F2F82788E69AB7C5DCBE4D0A5284

Function 009C42FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa21ff1292b09e6d3a81d94fe6da76e77f6f7b6adb319d298ea6402e9f52abda
Instruction ID: 539b864e3a704d6a5a0f34ec8a5ac4d2f05a6fa34ffff821d1cf0675148553a7
Opcode Fuzzy Hash: fa21ff1292b09e6d3a81d94fe6da76e77f6f7b6adb319d298ea6402e9f52abda
Instruction Fuzzy Hash: BA81D1B4811B00AFD360EF39D947797BEF4AB06211F404A2DE4EA97695E7306419CBE3

Function 009EE8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 83d49ded8526e6612fb771c0d310a8bcf614f1b82d3da81c16bed94c52dd3653
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 21516CB16087548FE314DF69D49435BBBE1BBC5318F044E2DE5E987351E379DA088B82

Function 009F7520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5079c141d373a3419cba59a88eadc1e632e1f1e1de3eb1b18c98876b9555c52d
Instruction ID: f9f676cad99a31ed46d4444fc03e39c39cf7a19e7b53b0d85aed3b05dd01d140
Opcode Fuzzy Hash: 5079c141d373a3419cba59a88eadc1e632e1f1e1de3eb1b18c98876b9555c52d
Instruction Fuzzy Hash: F451E83160C208ABCB159E58DC90B3FF7E6EB85754F284A2CE6D597391D731EC118B52

Function 009B5A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f63da9a5d2646a701583f9b6a602cb44909208a47a458305265ce1df78bd8e4
Instruction ID: 987c9807fab0c685a153e23b08f496b105219c3f24760fc48d641c5943b8c638
Opcode Fuzzy Hash: 6f63da9a5d2646a701583f9b6a602cb44909208a47a458305265ce1df78bd8e4
Instruction Fuzzy Hash: 595126B0A047149FC714DF14C981A6ABBA5FF85334F16466CF8999B352DB30EC42CB92

Function 009DEC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a0e3530714e3cd201bbd2408728aac368b49c110e053c573cda1a9fa32d19d
Instruction ID: 4503cc619fc2a80a059a91efbf6df7abc10e791dc4da0fd0cbc478096f5080f8
Opcode Fuzzy Hash: 63a0e3530714e3cd201bbd2408728aac368b49c110e053c573cda1a9fa32d19d
Instruction Fuzzy Hash: 55419D78940319DBDF20DF94DC91BA9B7B1FF0A340F144549E985AF3A0EB38A951CB91

Function 009F9B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48a6770500a437e0506ff83c129f6646a74d9b583e1c23e626eb731a9b3bbff
Instruction ID: ace735f2048a76bd7a9f9fc795467b857d0bf70326f14517ca9292754a0a489f
Opcode Fuzzy Hash: b48a6770500a437e0506ff83c129f6646a74d9b583e1c23e626eb731a9b3bbff
Instruction Fuzzy Hash: 7C419D34608348ABD710DF54D990B3BBBEAEB85714F24882CF6CA97251D335E801CF62

Function 009C2030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973ab34ec82ae16b46c4ceef06a57041f537062d2904952741115726c2490036
Instruction ID: c909050bb0e666eec79341398dd4517657fa1eb02aa5e30dd2b72739d22be5e9
Opcode Fuzzy Hash: 973ab34ec82ae16b46c4ceef06a57041f537062d2904952741115726c2490036
Instruction Fuzzy Hash: 0B41C772A0C3654FD35CCF29849473ABBE1AB85300F09C66EE4E6873D0DAB48945D782

Function 009C1E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a73700f41b9fd9c39d9617f9fd7e3a0664dcfde6d16899b439eeff26b25ae1
Instruction ID: 49226ee1fd164122220ceec6ac8037c5ec643ff71e23ba514a205471f67dfeea
Opcode Fuzzy Hash: a4a73700f41b9fd9c39d9617f9fd7e3a0664dcfde6d16899b439eeff26b25ae1
Instruction Fuzzy Hash: 7041EF749083809BD320AB55C884B2EFBF5FB8A784F14491DF6C497292C376D8148B6B

Function 009F8D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5893ec0ba5b7649d3e2ad86eab7613042ffdd86812304e68639cb99cf141f5
Instruction ID: da03dd5c7aef1cc534aca33f055d898c851cd8e4aea2ce382fb3fc2eab7f1100
Opcode Fuzzy Hash: 4b5893ec0ba5b7649d3e2ad86eab7613042ffdd86812304e68639cb99cf141f5
Instruction Fuzzy Hash: FC41A0316082598FC744DF68C49063FFBEAAF99300F198A1DD5D9D7291DB75DD018B82

Function 009CD961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef6df9ffa15e895cb815a35337f70ef89dd92ee66b3804c0142ac3f4029806e
Instruction ID: 085e57325e734c34d6d19424666d32dcf1f860b718cb16740441e68249d430c3
Opcode Fuzzy Hash: bef6df9ffa15e895cb815a35337f70ef89dd92ee66b3804c0142ac3f4029806e
Instruction Fuzzy Hash: 1B41C9B5A093858BD7309F10C881FABB3B4FF96360F04492DE48A8BA91E3754841CB57

Function 009EF030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: 3b49b29f912a463389116d17bbc850a93a92a96b30349b253cbb552579a32564
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 8C2137329082648BC3259B1AC49063BF7E8EBD9705F06863ED9C4A7295E335DC1087E1

Function 009F67EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c701a4083cca0990d2952caeedbbaf76a9ff9d973fc99c0382554e63ff5a93
Instruction ID: 37e15f3e87e8c1113e7d426bc53bbc79cbc3146ebaeea6815f5fe3e00bd703ba
Opcode Fuzzy Hash: 19c701a4083cca0990d2952caeedbbaf76a9ff9d973fc99c0382554e63ff5a93
Instruction Fuzzy Hash: 503113705183829AD714CF14C49062FBBF4EF96788F54580DF5C8AB261D338D985CB9A

Function 009D5E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931b8e62c778aeac7c7102a934452115c03d0d5cdac855c0c3c9407383fa46c0
Instruction ID: 38066f301b352fa7b018def2ea0b549fd49c21dfedd21f21a4639d8565de61b7
Opcode Fuzzy Hash: 931b8e62c778aeac7c7102a934452115c03d0d5cdac855c0c3c9407383fa46c0
Instruction Fuzzy Hash: F521A1B05082019BD310AF28C841A6BB7F8EF92765F458909F4D59B391E334D900CBA3

Function 009B49A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: ed199972ca0bd695c4601a0dfa380d26a87adff5ea9a560e08930d0df59c61c7
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 6531FC316482009BD7149E58DA80AABB7E5EFC4779F18892CE89AD7343D335DC42DB46

Function 00B5A575 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e091de623ae89c90e85893a7d1ec454e275112c54200dda1494eea0d4ee4f6b3
Instruction ID: 8aec498c75d9c9aa42a91ebf4d5730f832bb2e87115ad62b620dd521ac1265da
Opcode Fuzzy Hash: e091de623ae89c90e85893a7d1ec454e275112c54200dda1494eea0d4ee4f6b3
Instruction Fuzzy Hash: 6B2147B3D186249FE3006A29CC417A6B3A5EB95720F3F463CCED897380F97A9C0142C6

Function 009F64B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f26e5300d47b86f685223ba88ea85b49031a99160013b9771bbdf7677b01fded
Instruction ID: 82271c148c038b9e2371c8378cd7c2e5b3621f73e5e5ba8183a7a05d707ac6bb
Opcode Fuzzy Hash: f26e5300d47b86f685223ba88ea85b49031a99160013b9771bbdf7677b01fded
Instruction Fuzzy Hash: 0A216670A0C3059BC704EF59D590A2EFBEAEB95744F28881CE5C493261C335A852DF62

Function 009C0EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b34d11b00b7e7d8289598b10a1be956dec029646fd612a00634b9af2e46833a
Instruction ID: 75591af584491ff34a6cb40890095e4073e3a455b2f723699bb31921f773f336
Opcode Fuzzy Hash: 8b34d11b00b7e7d8289598b10a1be956dec029646fd612a00634b9af2e46833a
Instruction Fuzzy Hash: 4C2116B4E0021A9FEB15CF94CC90FBEBBB5FB4A304F144818E511AB292C735A951CB65

Function 009F5700 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a9f8a8b7da2cfcd22c130ed7a72498959366eff2a51fe3cd8966ae86756f11
Instruction ID: e5baa9123e29a04bbb8b999b8fa9bafb82cd7d45eeced91e3bf1937e2a84f960
Opcode Fuzzy Hash: 97a9f8a8b7da2cfcd22c130ed7a72498959366eff2a51fe3cd8966ae86756f11
Instruction Fuzzy Hash: 7211A37151C644EBC701EF58E840A2BBBF99F86710F058828E6C49B211D339D812CB93

Function 009EB650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 2d6a9aa1e26b02c6e5c03fab0845b1f5408db98af1d9ff1b2ea6e078c1521123
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 1F110C33A051D50EC7178D3D8440666BFE31AE3A34F5D4399F4B89B2D2D7238D8A8354

Function 009E0B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: e447c1637a1305c444f1de0e67411b023b6151acac6de1b57eecd96096574d01
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: 3A0171F6E0034657EB219E5695D1B3BB2ACBFC0728F1C452CE84657202DBB5EC45C6A1

Function 009DD1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9db728e7c71c1136f17932b326f45b3a4bb1491f497bb6f5b4ae5bc5ff15396
Instruction ID: 47e5d44cd4e81d0ccd5e5bf909ca0247908eef680b4633cd283e36e7ac154a40
Opcode Fuzzy Hash: d9db728e7c71c1136f17932b326f45b3a4bb1491f497bb6f5b4ae5bc5ff15396
Instruction Fuzzy Hash: E111ECB0408380AFD310DF618484A2FFBE5EBA6B54F248C0DF6A49B251C379E819CF56

Function 009B6EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f756126d11e34c6b751ff97c2ecf3bc3a11b2dd9a147b4b1bb59a03df24b09b
Instruction ID: 4e9bd7ae38ad50b0b7a88767b974577fb1703a74cf1796d72556b72bee58f78b
Opcode Fuzzy Hash: 3f756126d11e34c6b751ff97c2ecf3bc3a11b2dd9a147b4b1bb59a03df24b09b
Instruction Fuzzy Hash: D5F0593E72820A0BA210CDAAE88087BF3EAD7C9764B051538EE80C3201CD76F80292D4

Function 009EB8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 009CC5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 009CB410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 6b2cd01058b367130a451ea7766e647cc7dacd8576df6781955a33de199d4bf0
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 96F0ECB1E0851057DF26CA549CC1F37BB9CCB8B354F19042EE84557143D2615849C7E7

Function 009E8220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70f897de9ed23ebffd1f8b717d1dd47dfe2753e4550bf66d4b2c996a11f87ff
Instruction ID: 4bccc771d7c248ad179f72682a148e82ad5d471d795775f211d75b6b776403bf
Opcode Fuzzy Hash: e70f897de9ed23ebffd1f8b717d1dd47dfe2753e4550bf66d4b2c996a11f87ff
Instruction Fuzzy Hash: FF01DDB0414B009FC360EF29C945B5ABBE8EB08714F008A1DE8EECB680D770A5488B82

Function 009F1440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: fa720eb60debeb735ada5da8e81e8fa790d4d85178dc38c57e632fe35cab93b5
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 39D0A731608321869F748E19A400977F7F4EAC7B11F49955EF686E3198D330DC41C3E9

Function 009C1ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f96793f8414b2b75fb7f7027bacc6db26915f7236d92014d0d8a49a1678ce66
Instruction ID: bd507e2c6d57f332fadbac4a46cbc16f52d53d4fc52657b59d727c0c417cfac6
Opcode Fuzzy Hash: 6f96793f8414b2b75fb7f7027bacc6db26915f7236d92014d0d8a49a1678ce66
Instruction Fuzzy Hash: 60C01234A280008BC204CF40A8A9A32A6B8AB0B308710602ADA02E3632CA20C407E90A

Function 009F6094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0d5e563977ebe323876e7ecf4e2be91ebc5a0744c55a690014cd17a0c2cda9
Instruction ID: d3c6544573d628121b7ffd8b0a73df837aaba6fbb6a8b5006f009a96a751b272
Opcode Fuzzy Hash: 6d0d5e563977ebe323876e7ecf4e2be91ebc5a0744c55a690014cd17a0c2cda9
Instruction Fuzzy Hash: BEC02B3462C00893D50CCF04D800530F37E8B8770C720B00DC80223341C034C803850C

Function 009C1A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9237de3295226b80f467558fc686300c717e550f39fcf8eddcafd12eacb946
Instruction ID: 0f5f02c04488ae61959237c8918f23bb3f2e9549b612bd4a1617875e00afca54
Opcode Fuzzy Hash: fc9237de3295226b80f467558fc686300c717e550f39fcf8eddcafd12eacb946
Instruction Fuzzy Hash: 93C04C24A6D0408AC244CE85A8E5531A2A85707308710343A9A02E7672C560D405E50D

Function 009F5FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207429943.00000000009B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.2207411886.00000000009B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207476514.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207496691.0000000000A1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207514324.0000000000A1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207533442.0000000000A1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207657288.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207675373.0000000000B77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207760812.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207781012.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207799354.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207817273.0000000000B8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207837150.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207883604.0000000000B9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207905585.0000000000BA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207923373.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207941020.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207958564.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207976075.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208007013.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208025306.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208041822.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208059809.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208090065.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208107303.0000000000C05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208124971.0000000000C06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208144667.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208162480.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208180598.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208198128.0000000000C19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208215568.0000000000C1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208233864.0000000000C20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208255279.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208273771.0000000000C2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208291786.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208310660.0000000000C32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208332234.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208352098.0000000000C4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208370929.0000000000C7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208423560.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208443004.0000000000CA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208464411.0000000000CAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208506029.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208524594.0000000000CBE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f99f0ea8ea971fc3972c8e3d98e9c47fb090a8f1f25c674ef6c50e2260d5ce68
Instruction ID: fad6b71807cfe9725e251555bbaa5024add070a2b9c6f9f7131bce719a2c9870
Opcode Fuzzy Hash: f99f0ea8ea971fc3972c8e3d98e9c47fb090a8f1f25c674ef6c50e2260d5ce68
Instruction Fuzzy Hash: 0AC09225B69008ABEA4CCF59DD51A35F6BE9B8BB1CB14B02DC806A3256D134D913860C

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 009F50FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Function 009BFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 009BD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 009F5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 009F695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 009C049B Relevance: .3, Instructions: 264
COMMON

Function 009C0228 Relevance: .2, Instructions: 218
COMMON

Function 009F3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 009F3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON