Edit tour

Windows Analysis Report
dAYksbWyFS.exe

Overview

General Information

Sample name:	dAYksbWyFS.exe renamed because original name is a hash value
Original sample name:	0007f9d205fd99b833ed659b802b3c17a408cc0b.exe
Analysis ID:	1546794
MD5:	18390350844942315df7e588671b4b4e
SHA1:	0007f9d205fd99b833ed659b802b3c17a408cc0b
SHA256:	e57857d31f92e1a0d8290378e345749b42711777eee1af937a2b8b4fbafd9826
Tags:	exeReversingLabsuser-NDA0E
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

dAYksbWyFS.exe (PID: 6236 cmdline: "C:\Users\user\Desktop\dAYksbWyFS.exe" MD5: 18390350844942315DF7E588671B4B4E)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T15:55:26.771372+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.6	49774	TCP
2024-11-01T15:55:48.258634+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	57376	TCP
2024-11-01T15:55:49.408023+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	57384	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: dAYksbWyFS.exe

ReversingLabs: Detection: 86%

Machine Learning detection for sample

Source: dAYksbWyFS.exe

Joe Sandbox ML: detected

Source: dAYksbWyFS.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: dAYksbWyFS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\updater.exe.pdb source: dAYksbWyFS.exe
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\updater.exe.pdb source: dAYksbWyFS.exe

Source: C:\Users\user\Desktop\dAYksbWyFS.exe

Code function: 4x nop then movd mm0, dword ptr [edx]

0_2_005043C0

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:57384
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.6:49774
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:57376

Source: unknown	DNS traffic detected: query: 198.187.3.20.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 212.20.149.52.in-addr.arpa replaycode: Name error (3)

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 212.20.149.52.in-addr.arpa

Source: dAYksbWyFS.exe	String found in binary or memory: http://.css
Source: dAYksbWyFS.exe	String found in binary or memory: http://.jpg
Source: dAYksbWyFS.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: dAYksbWyFS.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: dAYksbWyFS.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: dAYksbWyFS.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: dAYksbWyFS.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: dAYksbWyFS.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: dAYksbWyFS.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: dAYksbWyFS.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: dAYksbWyFS.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dAYksbWyFS.exe	String found in binary or memory: http://html4/loose.dtd
Source: dAYksbWyFS.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: dAYksbWyFS.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: dAYksbWyFS.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: dAYksbWyFS.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: dAYksbWyFS.exe	String found in binary or memory: http://support.google.com/installer/
Source: dAYksbWyFS.exe	String found in binary or memory: http://support.google.com/installer/%s?product=%s&error=%d
Source: dAYksbWyFS.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: dAYksbWyFS.exe	String found in binary or memory: https://clients2.google.com/cr/report
Source: dAYksbWyFS.exe	String found in binary or memory: https://crashpad.chromium.org/
Source: dAYksbWyFS.exe	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: dAYksbWyFS.exe	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: dAYksbWyFS.exe	String found in binary or memory: https://dl.google.com/update2/installers/icons/
Source: dAYksbWyFS.exe	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: dAYksbWyFS.exe	String found in binary or memory: https://update.googleapis.com/service/update2/json
Source: dAYksbWyFS.exe	String found in binary or memory: https://update.googleapis.com/service/update2/jsonhttps://clients2.google.com/cr/reporthttps://m.goo

Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005C4050	0_2_005C4050
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00660000	0_2_00660000
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00776010	0_2_00776010
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0060A0B0	0_2_0060A0B0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0080C070	0_2_0080C070
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00746080	0_2_00746080
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0053A240	0_2_0053A240
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_006802C0	0_2_006802C0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0056A2A0	0_2_0056A2A0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0064C330	0_2_0064C330
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0070E460	0_2_0070E460
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0065E440	0_2_0065E440
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005CA470	0_2_005CA470
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0065A410	0_2_0065A410
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0058C420	0_2_0058C420
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005FC4D0	0_2_005FC4D0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0074E540	0_2_0074E540
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00748520	0_2_00748520
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005145D0	0_2_005145D0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007825F6	0_2_007825F6
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007825C6	0_2_007825C6
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00756610	0_2_00756610
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005FA620	0_2_005FA620
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005AC6F0	0_2_005AC6F0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_006806D0	0_2_006806D0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007986B0	0_2_007986B0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0051E710	0_2_0051E710
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0061C710	0_2_0061C710
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0078C7C9	0_2_0078C7C9
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0078C7C1	0_2_0078C7C1
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_006E67AB	0_2_006E67AB
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00668790	0_2_00668790
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00756870	0_2_00756870
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005F6810	0_2_005F6810
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007128C0	0_2_007128C0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0074C970	0_2_0074C970
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005D4910	0_2_005D4910
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_006309F0	0_2_006309F0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0076E9D0	0_2_0076E9D0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00618980	0_2_00618980
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00664980	0_2_00664980
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00788980	0_2_00788980
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0061CA20	0_2_0061CA20
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0061AA00	0_2_0061AA00
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0080EAF8	0_2_0080EAF8
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005E2A20	0_2_005E2A20
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00716AD0	0_2_00716AD0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00504A80	0_2_00504A80
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00644AB0	0_2_00644AB0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00748AA0	0_2_00748AA0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00698A80	0_2_00698A80
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005FAB50	0_2_005FAB50
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0067EBF0	0_2_0067EBF0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0052CB90	0_2_0052CB90
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00654CE0	0_2_00654CE0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00794C80	0_2_00794C80
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007E4C80	0_2_007E4C80
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0076AD74	0_2_0076AD74
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0076AD7C	0_2_0076AD7C
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0076AD60	0_2_0076AD60
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0076AD68	0_2_0076AD68
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005C2DC0	0_2_005C2DC0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00616D80	0_2_00616D80
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005ACE00	0_2_005ACE00
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00806E20	0_2_00806E20
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0060AEA0	0_2_0060AEA0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00642FE0	0_2_00642FE0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0064CFF0	0_2_0064CFF0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0074AFE0	0_2_0074AFE0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00787050	0_2_00787050
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00505010	0_2_00505010
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_008070E8	0_2_008070E8
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0053F020	0_2_0053F020
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007A10DA	0_2_007A10DA
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0067B0C0	0_2_0067B0C0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007A10B0	0_2_007A10B0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0059D0B0	0_2_0059D0B0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0076B080	0_2_0076B080
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00683170	0_2_00683170
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007A11F9	0_2_007A11F9
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0056B1C0	0_2_0056B1C0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007A11E1	0_2_007A11E1
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00801154	0_2_00801154
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00801158	0_2_00801158
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0080115C	0_2_0080115C
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00785270	0_2_00785270
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_008072A8	0_2_008072A8
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007A120E	0_2_007A120E
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00677210	0_2_00677210
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005D12C0	0_2_005D12C0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007A12D3	0_2_007A12D3
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_006992B0	0_2_006992B0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007A12A6	0_2_007A12A6
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00773290	0_2_00773290
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00675280	0_2_00675280
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005032A2	0_2_005032A2
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007A1281	0_2_007A1281
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00523340	0_2_00523340
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00713320	0_2_00713320
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007E5300	0_2_007E5300
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_006F53E1	0_2_006F53E1
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005F93D0	0_2_005F93D0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005E33A0	0_2_005E33A0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0050D457	0_2_0050D457
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005C3460	0_2_005C3460
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005D5430	0_2_005D5430
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00667410	0_2_00667410
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00587420	0_2_00587420
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0060B490	0_2_0060B490
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00583540	0_2_00583540
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_007D7540	0_2_007D7540
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00793500	0_2_00793500
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_006555E0	0_2_006555E0
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0085D510	0_2_0085D510
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_0080551C	0_2_0080551C
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_005E3590	0_2_005E3590
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00506500	0_2_00506500
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00684690	0_2_00684690
Source: C:\Users\user\Desktop\dAYksbWyFS.exe	Code function: 0_2_00507429	0_2_00507429

Source: dAYksbWyFS.exe, 00000000.00000000.2164857952.000000000092C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameupdater.exe> vs dAYksbWyFS.exe
Source: dAYksbWyFS.exe	Binary or memory string: OriginalFilenameupdater.exe> vs dAYksbWyFS.exe

Source: dAYksbWyFS.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.winEXE@1/0@2/0

Source: dAYksbWyFS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: dAYksbWyFS.exe

ReversingLabs: Detection: 86%

Source: dAYksbWyFS.exe	String found in binary or memory: http://support.google.com/installer/
Source: dAYksbWyFS.exe	String found in binary or memory: ..\..\chrome\updater\app\app_install_win.ccUpdate success.No updates.Updater error: http://support.google.com/installer/%s?product=%s&error=%d installation completed: error category[], error_code[], extra_code1[], completion_message[], post_install_launch_command_line[]oemSetOemInstallState failedStoreRunTimeEnrollmentToken failed
Source: dAYksbWyFS.exe	String found in binary or memory: https://dl.google.com/update2/installers/icons/
Source: dAYksbWyFS.exe	String found in binary or memory: .0\u to Write byteshttps://update.googleapis.com/service/update2/jsonhttps://clients2.google.com/cr/reporthttps://m.google.com/devicemanagement/data/apihttps://dl.google.com/update2/installers/icons/1:356l7w0
Source: dAYksbWyFS.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: dAYksbWyFS.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: dAYksbWyFS.exe	String found in binary or memory: --help display this help and exit
Source: dAYksbWyFS.exe	String found in binary or memory: --help display this help and exit
Source: dAYksbWyFS.exe	String found in binary or memory: overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script>
Source: dAYksbWyFS.exe	String found in binary or memory: asennuksen: $1oError sa pag-install: Nag-apply ang administrator ng network mo ng Group Policy na pumipigil sa pag-install: $1
Source: dAYksbWyFS.exe	String found in binary or memory: Tapos na ang pag-install.
Source: dAYksbWyFS.exe	String found in binary or memory: Kanselahin ang Pag-install
Source: dAYksbWyFS.exe	String found in binary or memory: Error sa pag-install: $1
Source: dAYksbWyFS.exe	String found in binary or memory: isvaatimuksia.fHindi na-install dahil hindi natutugunan ng iyong computer ang mga minimum na requirement sa hardware.mL'installation a
Source: dAYksbWyFS.exe	String found in binary or memory: Inihinto ang Pag-install.
Source: dAYksbWyFS.exe	String found in binary or memory: $1-installeerder
Source: dAYksbWyFS.exe	String found in binary or memory: $1-Installationsprogramm
Source: dAYksbWyFS.exe	String found in binary or memory: $1-installatieprogramma
Source: dAYksbWyFS.exe	String found in binary or memory: $1-installasjonsprogram
Source: dAYksbWyFS.exe	String found in binary or memory: .:Asennusvirhe: Asennusprosessin aloittaminen ei onnistunut.?Error sa pag-install: Hindi nagsimula ang proseso ng installer.GErreur d'installation
Source: dAYksbWyFS.exe	String found in binary or memory: .LAsennusvirhe: Asennusohjelmaa ei suoritettu loppuun. Asennus on keskeytetty.LError sa pag-install: Hindi natapos ang installer. Na-abort ang pag-install.tErreur d'installation
Source: dAYksbWyFS.exe	String found in binary or memory: Ini-install...
Source: dAYksbWyFS.exe	String found in binary or memory: 3Asennus ei ole valmis. Haluatko varmasti perua sen?IHindi nakumpleto ang pag-install. Sigurado ka bang gusto mong kanselahin?9Installation non termin
Source: dAYksbWyFS.exe	String found in binary or memory: uudelleen.#Hindi na-install. Pakisubukan ulit.,
Source: dAYksbWyFS.exe	String found in binary or memory: isen virheen takia.FHindi na-install dahil sa isang internal na error sa server ng update.Q
Source: dAYksbWyFS.exe	String found in binary or memory: ei tueta.OError sa pag-install: Invalid o hindi sinusuportahan ang filename ng installer.fErreur d'installation
Source: dAYksbWyFS.exe	String found in binary or memory: ivityspalvelimella ei ole tiivistedataa sovelluksesta.\Hindi na-install dahil walang anumang data ng hash para sa application ang server ng update.p
Source: dAYksbWyFS.exe	String found in binary or memory: n versiota ei tueta.QHindi na-install dahil hindi sinusuportahan ang bersyong ito ng operating system.ZL'installation a
Source: dAYksbWyFS.exe	String found in binary or memory: maassa.AHindi na-install dahil pinaghihigpitan ang access sa bansang ito.=L'installation a
Source: dAYksbWyFS.exe	String found in binary or memory: Ituloy ang Pag-install
Source: dAYksbWyFS.exe	String found in binary or memory: Nakansela ang pag-install.
Source: dAYksbWyFS.exe	String found in binary or memory: n.\Salamat sa pag-install. Dapat mong i-restart ang lahat ng iyong browser bago gamitin ang $1.eMerci d'avoir install
Source: dAYksbWyFS.exe	String found in binary or memory: n.SSalamat sa pag-install. Dapat mong i-restart ang iyong browser bago gamitin ang $1.aMerci d'avoir install
Source: dAYksbWyFS.exe	String found in binary or memory: n.TSalamat sa pag-install. Dapat mong i-restart ang iyong computer bago gamitin ang $1.aMerci d'avoir install
Source: dAYksbWyFS.exe	String found in binary or memory: .4Asennus ei onnistu, palvelin ei tunnista sovellusta.9Hindi na-install, hindi kilala ng server ang application.=Installation impossible. Le serveur ne reconna
Source: dAYksbWyFS.exe	String found in binary or memory: onnistui, koska protokollaa ei tueta.BHindi na-install dahil sa error na hindi sinusuportahang protocol.K
Source: dAYksbWyFS.exe	String found in binary or memory: si Windows-versiota ei tueta.IHindi na-install dahil hindi sinusuportahan ang iyong bersyon ng Windows.V
Source: dAYksbWyFS.exe	String found in binary or memory: Naghihintay sa pag-install...

Source: dAYksbWyFS.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: dAYksbWyFS.exe

Static file information: File size 4962863 > 1048576

Source: dAYksbWyFS.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x366000

Source: dAYksbWyFS.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: dAYksbWyFS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: dAYksbWyFS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\updater.exe.pdb source: dAYksbWyFS.exe
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\updater.exe.pdb source: dAYksbWyFS.exe

Source: dAYksbWyFS.exe

Static PE information: real checksum: 0x4b3e08 should be: 0x4bf8a9

Source: dAYksbWyFS.exe

Static PE information: section name: CPADinfo

Source: C:\Users\user\Desktop\dAYksbWyFS.exe

Code function: 0_2_006C6F2B push ecx; ret

0_2_006C6F3E

Source: C:\Users\user\Desktop\dAYksbWyFS.exe

Code function: 0_2_00501000 cpuid

0_2_00501000

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	Path Interception	Path Interception	2 Obfuscated Files or Information	OS Credential Dumping	1 System Information Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
dAYksbWyFS.exe	87%	ReversingLabs	Win32.Virus.Floxif
dAYksbWyFS.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
198.187.3.20.in-addr.arpa	unknown	unknown	false		unknown
212.20.149.52.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://html4/loose.dtd	dAYksbWyFS.exe	false	unknown
http://support.google.com/installer/%s?product=%s&error=%d	dAYksbWyFS.exe	false	unknown
https://crashpad.chromium.org/	dAYksbWyFS.exe	false	unknown
http://.css	dAYksbWyFS.exe	false	unknown
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	dAYksbWyFS.exe	false	unknown
https://m.google.com/devicemanagement/data/api	dAYksbWyFS.exe	false	unknown
http://.jpg	dAYksbWyFS.exe	false	unknown
https://crashpad.chromium.org/bug/new	dAYksbWyFS.exe	false	unknown
https://dl.google.com/update2/installers/icons/	dAYksbWyFS.exe	false	unknown
http://support.google.com/installer/	dAYksbWyFS.exe	false	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546794
Start date and time:	2024-11-01 15:54:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dAYksbWyFS.exe renamed because original name is a hash value
Original Sample Name:	0007f9d205fd99b833ed659b802b3c17a408cc0b.exe
Detection:	MAL
Classification:	mal52.winEXE@1/0@2/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 144
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target dAYksbWyFS.exe, PID 6236 because there are no executed function
VT rate limit hit for: dAYksbWyFS.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.816253871374478
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	dAYksbWyFS.exe
File size:	4'962'863 bytes
MD5:	18390350844942315df7e588671b4b4e
SHA1:	0007f9d205fd99b833ed659b802b3c17a408cc0b
SHA256:	e57857d31f92e1a0d8290378e345749b42711777eee1af937a2b8b4fbafd9826
SHA512:	e8612f992fd32f47d3d3ff565603aaf060f2594ae8605e3474a4aef909540be40ae79f80b17028635902e1eb8d7f291ff3d40006c6425a8d2d2deaffa440b184
SSDEEP:	98304:e+RpKOOSV1teI65yS8Ag+7BUqXUahb7oYF9tIwBxurtN37:e+RpPOSdeI65yh+7BzLZMYFnIwBxu337
TLSH:	38369D22F5A09170F5A23236B93C67395D333E329B3589CF86942CA46FB07D2653935B
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...7..f.........."......`6..........q............@...........................K......>K...@...........................@.P...8.@....

File Icon


Icon Hash:	2f232d67b7934633

Static PE Info

General

Entrypoint:	0x5c71f0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CBF037 [Mon Aug 26 03:02:15 2024 UTC]
TLS Callbacks:	0x515a60, 0x5c60f0, 0x4efe20, 0x5c58f0, 0x49f8c0, 0x50fc20
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	20ab254b36a04ea3556f60145d061fed

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
jmp 00007FA5E0C9AB62h
jmp 00007FA5E0CBE21Dh
mov ecx, dword ptr [00808040h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007FA5E0CBE3A6h
test esi, ecx
jne 00007FA5E0CBE3C8h
call 00007FA5E0CBE3D1h
mov ecx, eax
cmp ecx, edi
jne 00007FA5E0CBE3A9h
mov ecx, BB40E64Fh
jmp 00007FA5E0CBE3B0h
test esi, ecx
jne 00007FA5E0CBE3ACh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00808040h], ecx
not ecx
pop edi
mov dword ptr [00808080h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [0080218Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [008020ECh]
xor dword ptr [ebp-04h], eax
call dword ptr [008020E4h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00802290h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h
push 00010000h
push 00000000h
call 00007FA5E0CCE05Ah
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4011e7	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x401238	0x1a4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x422000	0x7ed00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4a6000	0x2868	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3fb9b0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3fb740	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x367218	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x401c64	0x888	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x401160	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x365f97	0x366000	28588a4097d34776b330277629531032	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x367000	0xa06d0	0xa0800	0e86f6aca0d03682c49d107663d58934	False	0.3671646831191589	data	6.197584652049431	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x408000	0x17e88	0x5600	b56710214665ff4596dc12b50d6871d6	False	0.12213844476744186	data	3.1582901854938568	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x420000	0x171	0x200	7e5b0ce4b7afe46cae111a29eb89d76f	False	0.07421875	data	0.34262747993819864	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
CPADinfo	0x421000	0x28	0x200	842689af09e7bf563672a4b43f1a2286	False	0.04296875	data	0.12227588125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x422000	0x7ed00	0x7ee00	edbd37e5a965d552dde348c6d612cde3	False	0.2842903325123153	data	5.382730601374703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4a1000	0x1ab44	0x1ac00	6d753dfb4dbbb1a7f1c0a268084e2f0d	False	0.6594626168224299	data	6.701981472446077	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TYPELIB	0x42cc00	0x1f30	data	English	United States	0.3572144288577154
TYPELIB	0x42eb30	0x974	data	English	United States	0.34917355371900827
TYPELIB	0x42f4a8	0x5198	data	English	United States	0.2967732669475297
TYPELIB	0x434640	0x1fac	data	English	United States	0.35360138135175134
TYPELIB	0x4365f0	0x984	data	English	United States	0.3460591133004926
TYPELIB	0x436f78	0x5858	data	English	United States	0.2998761938450654
RT_BITMAP	0x4282c0	0x4678	Device independent bitmap graphic, 100 x 60 x 24, image size 18000, resolution 3780 x 3780 px/m	English	United States	0.020343680709534368
RT_ICON	0x425b30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192, 16 important colors	English	United States	0.6317567567567568
RT_ICON	0x425c58	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.5823699421965318
RT_ICON	0x4261c0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640, 16 important colors	English	United States	0.5120967741935484
RT_ICON	0x4264a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.5455776173285198
RT_ICON	0x426d50	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.36341463414634145
RT_ICON	0x4273b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.42350746268656714
RT_DIALOG	0x42c938	0x204	data	English	United States	0.46124031007751937
RT_DIALOG	0x42cb40	0xc0	data	English	United States	0.5572916666666666
RT_STRING	0x43cc48	0xd0a	data	English	United States	0.4682444577591372
RT_STRING	0x43d958	0xdd2	data	English	United States	0.38157150932730355
RT_STRING	0x43e730	0xc0c	data	English	United States	0.5239948119325551
RT_STRING	0x43f340	0xd3c	Targa image data - Color 1072 x 1093 x 32 +1083 +1075 "\257\0045\0044\004 "	English	United States	0.4542502951593861
RT_STRING	0x440080	0xbac	data	English	United States	0.499665327978581
RT_STRING	0x440c30	0x396	data	English	United States	0.6285403050108932
RT_STRING	0x440fc8	0x2dc	data	English	United States	0.4959016393442623
RT_STRING	0x4412a8	0x282	data	English	United States	0.7819314641744548
RT_STRING	0x441530	0x2be	data	English	United States	0.603988603988604
RT_STRING	0x4417f0	0x2ce	data	English	United States	0.6782729805013927
RT_STRING	0x441ac0	0x1c6	data	English	United States	0.7026431718061674
RT_STRING	0x441c88	0x1d6	data	English	United States	0.5808510638297872
RT_STRING	0x441e60	0x1f0	data	English	United States	0.7701612903225806
RT_STRING	0x442050	0x1d8	data	English	United States	0.6334745762711864
RT_STRING	0x442228	0x1ca	data	English	United States	0.7183406113537117
RT_STRING	0x4423f8	0x21a	data	English	United States	0.6672862453531598
RT_STRING	0x442618	0x28e	data	English	United States	0.43577981651376146
RT_STRING	0x4428a8	0x27c	data	English	United States	0.7468553459119497
RT_STRING	0x442b28	0x2ae	data	English	United States	0.6749271137026239
RT_STRING	0x442dd8	0x280	data	English	United States	0.6296875
RT_STRING	0x443058	0x152	data	English	United States	0.7958579881656804
RT_STRING	0x4431b0	0xcc	data	English	United States	0.7401960784313726
RT_STRING	0x443280	0xd2	data	English	United States	0.8904761904761904
RT_STRING	0x443358	0xea	data	English	United States	0.8974358974358975
RT_STRING	0x443448	0xe8	data	English	United States	0.7931034482758621
RT_STRING	0x443530	0x124	data	English	United States	0.8561643835616438
RT_STRING	0x443658	0x20c	Targa image data - RLE 1083 x 1103 x 32 +1077 +1075 "A\0045\004."	English	United States	0.601145038167939
RT_STRING	0x443868	0x21c	data	English	United States	0.6611111111111111
RT_STRING	0x443a88	0x24c	data	English	United States	0.7261904761904762
RT_STRING	0x443cd8	0x1d2	data	English	United States	0.6609442060085837
RT_STRING	0x443eb0	0x200	data	English	United States	0.75
RT_STRING	0x4440b0	0x2ce	data	English	United States	0.564066852367688
RT_STRING	0x444380	0x298	data	English	United States	0.6204819277108434
RT_STRING	0x444618	0x278	data	English	United States	0.7848101265822784
RT_STRING	0x444890	0x2d2	Targa image data - Color 2379 x 2337 x 32 +2344 +2354 "8\011.\011M\011*\011(\011M\011(\011 "	English	United States	0.6481994459833795
RT_STRING	0x444b68	0x29a	data	English	United States	0.7087087087087087
RT_STRING	0x444e08	0x488	data	English	United States	0.5198275862068965
RT_STRING	0x445290	0x476	data	English	United States	0.4956217162872154
RT_STRING	0x445708	0x49c	data	English	United States	0.6466101694915254
RT_STRING	0x445ba8	0x456	data	English	United States	0.5540540540540541
RT_STRING	0x446000	0x3f8	data	English	United States	0.5974409448818898
RT_STRING	0x4463f8	0x460	data	English	United States	0.575
RT_STRING	0x446858	0x4b4	data	English	United States	0.46677740863787376
RT_STRING	0x446d10	0x478	data	English	United States	0.6354895104895105
RT_STRING	0x447188	0x470	data	English	United States	0.5598591549295775
RT_STRING	0x4475f8	0x41c	data	English	United States	0.5807984790874525
RT_STRING	0x447a18	0x426	data	English	United States	0.5790960451977402
RT_STRING	0x447e40	0x488	data	English	United States	0.45775862068965517
RT_STRING	0x4482c8	0x424	data	English	United States	0.6490566037735849
RT_STRING	0x4486f0	0x42c	data	English	United States	0.5608614232209738
RT_STRING	0x448b20	0x43a	data	English	United States	0.6090573012939002
RT_STRING	0x448f60	0x43c	data	English	United States	0.6199261992619927
RT_STRING	0x4493a0	0x59c	data	English	United States	0.435933147632312
RT_STRING	0x449940	0x500	Targa image data - Color 2379 x 2337 x 32 +2344 +2354 "\025\011@\011 "	English	United States	0.6640625
RT_STRING	0x449e40	0x59c	data	English	United States	0.5682451253481894
RT_STRING	0x44a3e0	0x536	data	English	United States	0.5907046476761619
RT_STRING	0x44a918	0x8e6	data	English	United States	0.5258999122036875
RT_STRING	0x44b200	0xc92	data	English	United States	0.3334369173399627
RT_STRING	0x44be98	0xbf4	data	English	United States	0.5320261437908497
RT_STRING	0x44ca90	0xc5e	data	English	United States	0.48673404927353126
RT_STRING	0x44d6f0	0xcd8	data	English	United States	0.4382603406326034
RT_STRING	0x44e3c8	0x92c	data	English	United States	0.5404599659284497
RT_STRING	0x44ecf8	0x9ce	data	English	United States	0.3669322709163347
RT_STRING	0x44f6c8	0x962	data	English	United States	0.5104079933388843
RT_STRING	0x450030	0x986	data	English	United States	0.5332239540607056
RT_STRING	0x4509b8	0x9d8	data	English	United States	0.4765873015873016
RT_STRING	0x451390	0x8ec	data	English	United States	0.563922942206655
RT_STRING	0x451c80	0xcc6	data	English	United States	0.382262996941896
RT_STRING	0x452948	0xca8	data	English	United States	0.4367283950617284
RT_STRING	0x4535f0	0xcbe	data	English	United States	0.5076640098099325
RT_STRING	0x4542b0	0xd0c	data	English	United States	0.4224550898203593
RT_STRING	0x454fc0	0x8a6	data	English	United States	0.5519421860885275
RT_STRING	0x455868	0x256	data	English	United States	0.4983277591973244
RT_STRING	0x455ac0	0x260	data	English	United States	0.5444078947368421
RT_STRING	0x455d20	0x22e	data	English	United States	0.6505376344086021
RT_STRING	0x455f50	0x23a	data	English	United States	0.5333333333333333
RT_STRING	0x456190	0x288	data	English	United States	0.6388888888888888
RT_STRING	0x456418	0x7a6	data	English	United States	0.49284984678243104
RT_STRING	0x456bc0	0x820	data	English	United States	0.46923076923076923
RT_STRING	0x4573e0	0x6be	data	English	United States	0.6292004634994206
RT_STRING	0x457aa0	0x7d8	data	English	United States	0.4960159362549801
RT_STRING	0x458278	0x636	data	English	United States	0.5943396226415094
RT_STRING	0x4588b0	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x458990	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x458a70	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x458b50	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x458c30	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x458d10	0x2c4	data	English	United States	0.634180790960452
RT_STRING	0x458fd8	0x30e	data	English	United States	0.45524296675191817
RT_STRING	0x4592e8	0x2b2	data	English	United States	0.6768115942028986
RT_STRING	0x4595a0	0x318	data	English	United States	0.5732323232323232
RT_STRING	0x4598b8	0x326	data	English	United States	0.6178660049627791
RT_STRING	0x459be0	0x2da	data	English	United States	0.6328767123287671
RT_STRING	0x459ec0	0x362	data	English	United States	0.3972286374133949
RT_STRING	0x45a228	0x2f4	data	English	United States	0.6666666666666666
RT_STRING	0x45a520	0x302	data	English	United States	0.5324675324675324
RT_STRING	0x45a828	0x35a	data	English	United States	0.5722610722610723
RT_STRING	0x45ab88	0x2ca	data	English	United States	0.6442577030812325
RT_STRING	0x45ae58	0x2b0	data	English	United States	0.39098837209302323
RT_STRING	0x45b108	0x2ba	data	English	United States	0.670487106017192
RT_STRING	0x45b3c8	0x2f0	data	English	United States	0.6316489361702128
RT_STRING	0x45b6b8	0x2fa	data	English	United States	0.573490813648294
RT_STRING	0x45b9b8	0x2c2	data	English	United States	0.6147308781869688
RT_STRING	0x45bc80	0x34c	data	English	United States	0.39691943127962087
RT_STRING	0x45bfd0	0x3a4	data	English	United States	0.5482832618025751
RT_STRING	0x45c378	0x34c	data	English	United States	0.566350710900474
RT_STRING	0x45c6c8	0x372	data	English	United States	0.4580498866213152
RT_STRING	0x45ca40	0x2a4	data	English	United States	0.628698224852071
RT_STRING	0x45cce8	0x29a	data	English	United States	0.506006006006006
RT_STRING	0x45cf88	0x2b4	data	English	United States	0.5520231213872833
RT_STRING	0x45d240	0x290	data	English	United States	0.6829268292682927
RT_STRING	0x45d4d0	0x274	data	English	United States	0.5589171974522293
RT_STRING	0x45d748	0x252	data	English	United States	0.6936026936026936
RT_STRING	0x45d9a0	0x35a	data	English	United States	0.5233100233100233
RT_STRING	0x45dd00	0x354	data	English	United States	0.5446009389671361
RT_STRING	0x45e058	0x31c	data	English	United States	0.6947236180904522
RT_STRING	0x45e378	0x342	data	English	United States	0.5203836930455635
RT_STRING	0x45e6c0	0x314	data	English	United States	0.6421319796954315
RT_STRING	0x45e9d8	0x48a	data	English	United States	0.5223752151462995
RT_STRING	0x45ee68	0x4c2	data	English	United States	0.4852216748768473
RT_STRING	0x45f330	0x3c6	data	English	United States	0.6635610766045549
RT_STRING	0x45f6f8	0x480	data	English	United States	0.5234375
RT_STRING	0x45fb78	0x400	data	English	United States	0.59765625
RT_STRING	0x45ff78	0xce	data	English	United States	0.8786407766990292
RT_STRING	0x460048	0xc6	data	English	United States	0.7878787878787878
RT_STRING	0x460110	0xde	data	English	United States	0.9324324324324325
RT_STRING	0x4601f0	0xd2	data	English	United States	0.8
RT_STRING	0x4602c8	0xd6	data	English	United States	0.8925233644859814
RT_STRING	0x4603a0	0x9f8	data	English	United States	0.5144984326018809
RT_STRING	0x460d98	0xbe6	data	English	United States	0.40151017728168087
RT_STRING	0x461980	0xa52	data	English	United States	0.5825132475397427
RT_STRING	0x4623d8	0xbd0	data	English	United States	0.4728835978835979
RT_STRING	0x462fa8	0xb1e	data	English	United States	0.5358397751229796
RT_STRING	0x463ac8	0x308	data	English	United States	0.663659793814433
RT_STRING	0x463dd0	0x210	data	English	United States	0.5075757575757576
RT_STRING	0x463fe0	0x210	data	English	United States	0.7821969696969697
RT_STRING	0x4641f0	0x1fa	AmigaOS bitmap font "n", fc_YSize 14345, 18688 elements, 2nd "0\011A\0115\011>\011$\011 ", 3rd	English	United States	0.6304347826086957
RT_STRING	0x4643f0	0x236	data	English	United States	0.6554770318021201
RT_STRING	0x464628	0x25a	data	English	United States	0.654485049833887
RT_STRING	0x464888	0x2fa	data	English	United States	0.4658792650918635
RT_STRING	0x464b88	0x302	data	English	United States	0.7324675324675325
RT_STRING	0x464e90	0x2e2	data	English	United States	0.6653116531165312
RT_STRING	0x465178	0x2f2	data	English	United States	0.603448275862069
RT_STRING	0x465470	0x1e4	data	English	United States	0.7148760330578512
RT_STRING	0x465658	0x2b4	data	English	United States	0.4479768786127168
RT_STRING	0x465910	0x25c	data	English	United States	0.5927152317880795
RT_STRING	0x465b70	0x20e	data	English	United States	0.629277566539924
RT_STRING	0x465d80	0x25e	data	English	United States	0.5247524752475248
RT_STRING	0x465fe0	0x398	data	English	United States	0.6478260869565218
RT_STRING	0x466378	0x82e	data	English	United States	0.3997134670487106
RT_STRING	0x466ba8	0x7a2	data	English	United States	0.46827021494370524
RT_STRING	0x467350	0x772	data	English	United States	0.5503672612801679
RT_STRING	0x467ac8	0x7c2	data	English	United States	0.44511581067472306
RT_STRING	0x468290	0x68e	data	English	United States	0.5917759237187128
RT_STRING	0x468920	0xa90	data	English	United States	0.3742603550295858
RT_STRING	0x4693b0	0xa96	data	English	United States	0.4022140221402214
RT_STRING	0x469e48	0x92e	data	English	United States	0.5404255319148936
RT_STRING	0x46a778	0xa8a	data	English	United States	0.4099332839140104
RT_STRING	0x46b208	0x76a	data	English	United States	0.5379346680716544
RT_STRING	0x46b978	0x236	AmigaOS bitmap font "'\0061\006M\006 ", fc_YSize 29696, 11270 elements, 2nd "l", 3rd "l"	English	United States	0.598939929328622
RT_STRING	0x46bbb0	0x1ec	data	English	United States	0.5711382113821138
RT_STRING	0x46bda0	0x1f4	data	English	United States	0.752
RT_STRING	0x46bf98	0x1f8	data	English	United States	0.6031746031746031
RT_STRING	0x46c190	0x1bc	data	English	United States	0.6959459459459459
RT_STRING	0x46c350	0x33a	data	English	United States	0.6186440677966102
RT_STRING	0x46c690	0x386	data	English	United States	0.532150776053215
RT_STRING	0x46ca18	0x32a	data	English	United States	0.682716049382716
RT_STRING	0x46cd48	0x346	data	English	United States	0.5930787589498807
RT_STRING	0x46d090	0x2d8	data	English	United States	0.6483516483516484
RT_STRING	0x46d368	0x6fa	data	English	United States	0.5481522956326987
RT_STRING	0x46da68	0x810	data	English	United States	0.438953488372093
RT_STRING	0x46e278	0x640	data	English	United States	0.644375
RT_STRING	0x46e8b8	0x79e	data	English	United States	0.5174358974358975
RT_STRING	0x46f058	0x766	data	English	United States	0.5739176346356917
RT_STRING	0x46f7c0	0x490	data	English	United States	0.5958904109589042
RT_STRING	0x46fc50	0x5bc	data	English	United States	0.44141689373297005
RT_STRING	0x470210	0x47a	data	English	United States	0.68760907504363
RT_STRING	0x470690	0x560	data	English	United States	0.5697674418604651
RT_STRING	0x470bf0	0x53c	data	English	United States	0.5835820895522388
RT_STRING	0x471130	0x66a	data	English	United States	0.5773447015834349
RT_STRING	0x4717a0	0x96c	data	English	United States	0.36525704809286896
RT_STRING	0x472110	0x7e2	data	English	United States	0.5906838453914767
RT_STRING	0x4728f8	0x850	data	English	United States	0.5596804511278195
RT_STRING	0x473148	0x8da	data	English	United States	0.4929390997352162
RT_STRING	0x473a28	0x76e	data	English	United States	0.5825446898002103
RT_STRING	0x474198	0xa5a	data	English	United States	0.37471698113207547
RT_STRING	0x474bf8	0xa3e	data	English	United States	0.4767353165522502
RT_STRING	0x475638	0x9be	data	English	United States	0.5288692862870891
RT_STRING	0x475ff8	0xa18	data	English	United States	0.45859133126934987
RT_STRING	0x476a10	0x4fe	data	English	United States	0.6048513302034428
RT_STRING	0x476f10	0x14e	data	English	United States	0.5718562874251497
RT_STRING	0x477060	0x126	data	English	United States	0.7482993197278912
RT_STRING	0x477188	0x144	data	English	United States	0.8333333333333334
RT_STRING	0x4772d0	0x142	data	English	United States	0.6149068322981367
RT_STRING	0x477418	0x328	data	English	United States	0.6732673267326733
RT_STRING	0x477740	0xc14	data	English	United States	0.40297542043984474
RT_STRING	0x478358	0xc0e	data	English	United States	0.4539857420609203
RT_STRING	0x478f68	0xa9e	data	English	United States	0.579102281089036
RT_STRING	0x479a08	0xb32	data	English	United States	0.4605722260990928
RT_STRING	0x47a540	0x99c	data	English	United States	0.5650406504065041
RT_STRING	0x47aee0	0xe0c	data	English	United States	0.4582869855394883
RT_STRING	0x47bcf0	0xe42	data	English	United States	0.42219178082191783
RT_STRING	0x47cb38	0xd36	data	English	United States	0.5671200473092844
RT_STRING	0x47d870	0xea0	data	English	United States	0.47489316239316237
RT_STRING	0x47e710	0xcae	data	English	United States	0.5274183610597659
RT_STRING	0x47f3c0	0x38a	data	English	United States	0.6158940397350994
RT_STRING	0x47f750	0x3e0	data	English	United States	0.5120967741935484
RT_STRING	0x47fb30	0x2f0	data	English	United States	0.7526595744680851
RT_STRING	0x47fe20	0x38a	data	English	United States	0.5894039735099338
RT_STRING	0x4801b0	0x362	data	English	United States	0.6674364896073903
RT_STRING	0x480518	0x8cc	data	English	United States	0.5146536412078153
RT_STRING	0x480de8	0xa5e	data	English	United States	0.3918613413715147
RT_STRING	0x481848	0x8da	data	English	United States	0.588261253309797
RT_STRING	0x482128	0x9d6	data	English	United States	0.4749801429706116
RT_STRING	0x482b00	0x982	data	English	United States	0.5283483976992605
RT_STRING	0x483488	0x326	data	English	United States	0.684863523573201
RT_STRING	0x4837b0	0x29c	AmigaOS bitmap font "e", fc_YSize 27392, 18176 elements, 2nd "i", 3rd "e"	English	United States	0.5209580838323353
RT_STRING	0x483a50	0x26e	data	English	United States	0.7781350482315113
RT_STRING	0x483cc0	0x2c4	data	English	United States	0.6214689265536724
RT_STRING	0x483f88	0x298	data	English	United States	0.6867469879518072
RT_STRING	0x484220	0x22a	data	English	United States	0.7274368231046932
RT_STRING	0x484450	0x226	data	English	United States	0.5254545454545455
RT_STRING	0x484678	0x22a	AmigaOS bitmap font "e", fc_YSize 21248, 20992 elements, 2nd "k", 3rd "\260\014\202\014\255\014\277\014\270\014\277\014\010"	English	United States	0.7833935018050542
RT_STRING	0x4848a8	0x28a	data	English	United States	0.7076923076923077
RT_STRING	0x484b38	0x238	AmigaOS bitmap font "e", fc_YSize 13572, 20992 elements, 2nd "B\0040\004@\004B\004C\004X\004 ", 3rd "I\016\024"	English	United States	0.6566901408450704
RT_STRING	0x484d70	0x4cc	data	English	United States	0.6172638436482085
RT_STRING	0x485240	0x8a0	data	English	United States	0.4134963768115942
RT_STRING	0x485ae0	0x864	data	English	United States	0.5591247672253259
RT_STRING	0x486348	0x7cc	data	English	United States	0.593687374749499
RT_STRING	0x486b18	0x84e	data	English	United States	0.5174035747883349
RT_STRING	0x487368	0x4ce	data	English	United States	0.6650406504065041
RT_STRING	0x487838	0x2b2	data	English	United States	0.5289855072463768
RT_STRING	0x487af0	0x2e0	AmigaOS bitmap font "a", fc_YSize 4294950666, 18944 elements, 2nd "\276", 3rd "P"	English	United States	0.6073369565217391
RT_STRING	0x487dd0	0x2d0	data	English	United States	0.725
RT_STRING	0x4880a0	0x2ae	data	English	United States	0.5962099125364432
RT_STRING	0x488350	0x288	data	English	United States	0.7577160493827161
RT_STRING	0x4885d8	0x3c6	data	English	United States	0.4927536231884058
RT_STRING	0x4889a0	0x398	data	English	United States	0.5576086956521739
RT_STRING	0x488d38	0x320	data	English	United States	0.74125
RT_STRING	0x489058	0x364	data	English	United States	0.5725806451612904
RT_STRING	0x4893c0	0x3d0	data	English	United States	0.6567622950819673
RT_STRING	0x489790	0xb96	data	English	United States	0.45853000674308836
RT_STRING	0x48a328	0xc0c	data	English	United States	0.44520103761348895
RT_STRING	0x48af38	0xae2	data	English	United States	0.5918880114860015
RT_STRING	0x48ba20	0xc86	data	English	United States	0.48378041172801
RT_STRING	0x48c6a8	0xad2	data	English	United States	0.523826714801444
RT_STRING	0x48d180	0xaa6	data	English	United States	0.5135730007336757
RT_STRING	0x48dc28	0xb1e	data	English	United States	0.4328882642304989
RT_STRING	0x48e748	0xa1a	data	English	United States	0.5916473317865429
RT_STRING	0x48f168	0xb76	data	English	United States	0.5
RT_STRING	0x48fce0	0xa9a	data	English	United States	0.523581429624171
RT_STRING	0x490780	0xa36	data	English	United States	0.5198928844682479
RT_STRING	0x4911b8	0xb0a	data	English	United States	0.4157820240622788
RT_STRING	0x491cc8	0xa1a	data	English	United States	0.58584686774942
RT_STRING	0x4926e8	0xb88	data	English	United States	0.47696476964769646
RT_STRING	0x493270	0xb78	data	English	United States	0.5085149863760218
RT_STRING	0x493de8	0x69a	data	English	United States	0.5792899408284023
RT_STRING	0x494488	0x7e8	data	English	United States	0.39377470355731226
RT_STRING	0x494c70	0x774	data	English	United States	0.5922431865828093
RT_STRING	0x4953e8	0x750	data	English	United States	0.5133547008547008
RT_STRING	0x495b38	0x790	data	English	United States	0.5485537190082644
RT_STRING	0x4962c8	0x62c	data	English	United States	0.5905063291139241
RT_STRING	0x4968f8	0x8ee	data	English	United States	0.37445319335083116
RT_STRING	0x4971e8	0x83e	data	English	United States	0.590047393364929
RT_STRING	0x497a28	0x828	data	English	United States	0.5483716475095786
RT_STRING	0x498250	0x85a	data	English	United States	0.49251637043966323
RT_STRING	0x498ab0	0x6d8	data	English	United States	0.605593607305936
RT_STRING	0x499188	0x852	data	English	United States	0.39624413145539905
RT_STRING	0x4999e0	0x878	data	English	United States	0.5166051660516605
RT_STRING	0x49a258	0x7d4	data	English	United States	0.5773453093812375
RT_STRING	0x49aa30	0x7ee	data	English	United States	0.4945812807881773
RT_STRING	0x49b220	0x454	data	English	United States	0.6561371841155235
RT_STRING	0x49b678	0xd2	data	English	United States	0.8047619047619048
RT_STRING	0x49b750	0xd8	data	English	United States	0.8472222222222222
RT_STRING	0x49b828	0xe8	data	English	United States	0.875
RT_STRING	0x49b910	0xdc	data	English	United States	0.7772727272727272
RT_STRING	0x49b9f0	0x28c	data	English	United States	0.7147239263803681
RT_STRING	0x49bc80	0x976	data	English	United States	0.4149463253509496
RT_STRING	0x49c5f8	0x8e0	data	English	United States	0.4652288732394366
RT_STRING	0x49ced8	0x812	data	English	United States	0.5880929332042595
RT_STRING	0x49d6f0	0x8e6	data	English	United States	0.44688323090430204
RT_STRING	0x49dfd8	0x70c	data	English	United States	0.5598669623059866
RT_STRING	0x49e6e8	0x3e6	data	English	United States	0.531062124248497
RT_STRING	0x49ead0	0x362	data	English	United States	0.4907621247113164
RT_STRING	0x49ee38	0x3b2	data	English	United States	0.671247357293869
RT_STRING	0x49f1f0	0x37a	data	English	United States	0.5573033707865168
RT_STRING	0x49f570	0x312	data	English	United States	0.6513994910941476
RT_STRING	0x49f888	0x368	data	English	United States	0.5791284403669725
RT_STRING	0x49fbf0	0x35e	data	English	United States	0.5127610208816705
RT_STRING	0x49ff50	0x326	data	English	United States	0.6923076923076923
RT_STRING	0x4a0278	0x37e	data	English	United States	0.610738255033557
RT_STRING	0x4a05f8	0x2d6	data	English	United States	0.6556473829201102
RT_STRING	0x4a08d0	0x54	data	English	United States	0.6666666666666666
RT_GROUP_ICON	0x428260	0x5a	data	English	United States	0.7333333333333333
RT_VERSION	0x43c7d0	0x474	data	English	United States	0.4412280701754386
RT_MANIFEST	0x4a0928	0x3d2	XML 1.0 document, ASCII text, with very long lines (864)	English	United States	0.5398773006134969

Imports

DLL	Import
ADVAPI32.dll	AddAce, AllocateAndInitializeSid, BuildExplicitAccessWithNameW, BuildSecurityDescriptorW, BuildTrusteeWithSidW, ChangeServiceConfigW, CheckTokenMembership, CloseServiceHandle, ConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertStringSidToSidW, CopySid, CreateProcessAsUserW, CreateServiceW, DeleteService, DuplicateTokenEx, EqualSid, FreeSid, GetAce, GetAclInformation, GetLengthSid, GetNamedSecurityInfoW, GetSecurityDescriptorControl, GetSecurityDescriptorDacl, GetSecurityDescriptorGroup, GetSecurityDescriptorLength, GetSecurityDescriptorOwner, GetSecurityDescriptorSacl, GetSecurityInfo, GetSidIdentifierAuthority, GetSidLengthRequired, GetSidSubAuthority, GetSidSubAuthorityCount, GetTokenInformation, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, ImpersonateLoggedOnUser, ImpersonateNamedPipeClient, InitializeAcl, InitializeSecurityDescriptor, InitializeSid, IsValidAcl, IsValidSecurityDescriptor, IsValidSid, LookupAccountSidW, MakeAbsoluteSD, MakeSelfRelativeSD, OpenProcessToken, OpenSCManagerW, OpenServiceW, OpenThreadToken, QueryServiceConfigW, RegCloseKey, RegCreateKeyExW, RegDeleteKeyExW, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegOpenKeyExW, RegQueryInfoKeyW, RegQueryValueExA, RegQueryValueExW, RegSetValueExW, RegisterServiceCtrlHandlerW, RegisterTraceGuidsW, RevertToSelf, SetEntriesInAclW, SetNamedSecurityInfoW, SetSecurityDescriptorDacl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, SetSecurityInfo, SetServiceStatus, StartServiceCtrlDispatcherW, TraceEvent, UnregisterTraceGuids
dbghelp.dll	SymCleanup, SymFromAddr, SymGetLineFromAddr64, SymGetSearchPathW, SymInitialize, SymSetOptions, SymSetSearchPathW
GDI32.dll	BitBlt, CombineRgn, CreateCompatibleBitmap, CreateCompatibleDC, CreateFontIndirectW, CreateRectRgn, CreateRectRgnIndirect, CreateSolidBrush, DPtoLP, DeleteDC, DeleteObject, ExtTextOutW, FillRgn, GetDeviceCaps, GetObjectW, GetRegionData, GetStockObject, GetTextMetricsW, OffsetRgn, SelectObject, SetBkColor, SetTextColor, SetViewportOrgEx
MSIMG32.dll	GradientFill
OLEAUT32.dll	LoadRegTypeLib, LoadTypeLib, OleCreateFontIndirect, OleLoadPicturePath, SafeArrayAccessData, SafeArrayCreateVector, SafeArrayDestroy, SafeArrayGetDim, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayGetVartype, SafeArrayUnaccessData, SysAllocString, SysAllocStringByteLen, SysAllocStringLen, SysFreeString, SysStringLen, SystemTimeToVariantTime, VariantClear, VariantInit
SHELL32.dll	CommandLineToArgvW, SHGetFolderPathW, SHGetKnownFolderPath, ShellExecuteExW
USER32.dll	AllowSetForegroundWindow, BeginPaint, CallWindowProcW, CharNextW, CharUpperW, ClientToScreen, CopyImage, CopyRect, CreateAcceleratorTableW, CreateDialogIndirectParamW, CreateWindowExW, DefWindowProcW, DestroyAcceleratorTable, DestroyIcon, DestroyWindow, DispatchMessageW, EnableMenuItem, EnableWindow, EndDialog, EndPaint, EnumChildWindows, FillRect, FrameRect, GetActiveWindow, GetClassInfoExW, GetClassNameW, GetClientRect, GetCursorPos, GetDC, GetDesktopWindow, GetDlgItem, GetFocus, GetMenuState, GetMessageW, GetMonitorInfoW, GetParent, GetQueueStatus, GetSysColor, GetSysColorBrush, GetSystemMenu, GetSystemMetrics, GetTopWindow, GetWindow, GetWindowLongW, GetWindowRect, GetWindowTextLengthW, GetWindowTextW, InflateRect, InvalidateRect, InvalidateRgn, IsChild, IsDialogMessageW, IsMenu, IsRectEmpty, IsWindow, IsWindowVisible, KillTimer, LoadCursorW, LoadImageW, MapDialogRect, MapWindowPoints, MonitorFromWindow, MoveWindow, MsgWaitForMultipleObjectsEx, OffsetRect, PeekMessageW, PostMessageW, PostQuitMessage, PostThreadMessageW, RedrawWindow, RegisterClassExW, RegisterClassW, RegisterWindowMessageW, ReleaseCapture, ReleaseDC, ScreenToClient, SendDlgItemMessageW, SendMessageW, SetActiveWindow, SetCapture, SetDlgItemTextW, SetFocus, SetForegroundWindow, SetTimer, SetWindowContextHelpId, SetWindowLongW, SetWindowPos, SetWindowTextW, ShowWindow, SystemParametersInfoW, TranslateMessage, UnregisterClassW, UpdateWindow
KERNEL32.dll	AcquireSRWLockExclusive, AcquireSRWLockShared, AddVectoredExceptionHandler, AssignProcessToJobObject, CloseHandle, CompareStringW, ConnectNamedPipe, CopyFileW, CreateDirectoryW, CreateEventW, CreateFileA, CreateFileMappingW, CreateFileW, CreateIoCompletionPort, CreateMutexW, CreateNamedPipeW, CreatePipe, CreateProcessW, CreateSemaphoreW, CreateThread, CreateToolhelp32Snapshot, DecodePointer, DeleteCriticalSection, DeleteFileW, DeleteProcThreadAttributeList, DisconnectNamedPipe, DuplicateHandle, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExpandEnvironmentStringsW, FileTimeToLocalFileTime, FileTimeToSystemTime, FindClose, FindFirstFileExW, FindNextFileW, FindResourceExW, FindResourceW, FlushFileBuffers, FlushInstructionCache, FlushViewOfFile, FormatMessageA, FormatMessageW, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetComputerNameW, GetConsoleMode, GetConsoleOutputCP, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDateFormatW, GetDiskFreeSpaceExW, GetDriveTypeW, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesExW, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileSizeEx, GetFileTime, GetFileType, GetFullPathNameW, GetLastError, GetLocalTime, GetLocaleInfoW, GetLogicalProcessorInformation, GetLogicalProcessorInformationEx, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetNativeSystemInfo, GetOEMCP, GetProcAddress, GetProcessHeap, GetProcessId, GetProcessMitigationPolicy, GetProcessTimes, GetProductInfo, GetQueuedCompletionStatus, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemDefaultLCID, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetTempPathW, GetThreadContext, GetThreadId, GetThreadLocale, GetThreadPreferredUILanguages, GetThreadPriority, GetTickCount, GetTimeFormatW, GetTimeZoneInformation, GetUserDefaultLCID, GetUserPreferredUILanguages, GetVersionExW, GetWindowsDirectoryW, GlobalAlloc, GlobalFree, GlobalHandle, GlobalLock, GlobalMemoryStatusEx, GlobalUnlock, HeapAlloc, HeapDestroy, HeapFree, HeapReAlloc, HeapSetInformation, HeapSize, InitOnceExecuteOnce, InitializeConditionVariable, InitializeCriticalSection, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeProcThreadAttributeList, InitializeSListHead, InitializeSRWLock, InterlockedPopEntrySList, InterlockedPushEntrySList, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, IsWow64Process, K32GetModuleInformation, LCMapStringW, LeaveCriticalSection, LoadLibraryExA, LoadLibraryExW, LoadLibraryW, LoadResource, LocalFree, LockFileEx, LockResource, MapViewOfFile, MoveFileExW, MoveFileW, MulDiv, MultiByteToWideChar, OpenProcess, OutputDebugStringA, OutputDebugStringW, PeekNamedPipe, PostQueuedCompletionStatus, Process32FirstW, Process32NextW, ProcessIdToSessionId, QueryFullProcessImageNameW, QueryPerformanceCounter, QueryPerformanceFrequency, QueryThreadCycleTime, RaiseException, ReadConsoleW, ReadFile, ReadProcessMemory, RegisterWaitForSingleObject, ReleaseMutex, ReleaseSRWLockExclusive, ReleaseSRWLockShared, ReleaseSemaphore, RemoveDirectoryW, RemoveVectoredExceptionHandler, ReplaceFileW, ResetEvent, ResumeThread, RtlCaptureStackBackTrace, RtlUnwind, SetConsoleCtrlHandler, SetCurrentDirectoryW, SetEndOfFile, SetEnvironmentVariableW, SetEvent, SetFileAttributesW, SetFileInformationByHandle, SetFilePointer, SetFilePointerEx, SetFileTime, SetHandleInformation, SetLastError, SetNamedPipeHandleState, SetProcessShutdownParameters, SetStdHandle, SetThreadInformation, SetThreadPriority, SetUnhandledExceptionFilter, SizeofResource, Sleep, SleepConditionVariableSRW, SleepEx, SuspendThread, SwitchToThread, SystemTimeToFileTime, SystemTimeToTzSpecificLocalTime, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TransactNamedPipe, TryAcquireSRWLockExclusive, TzSpecificLocalTimeToSystemTime, UnhandledExceptionFilter, UnlockFileEx, UnmapViewOfFile, UnregisterWaitEx, UpdateProcThreadAttribute, VerSetConditionMask, VerifyVersionInfoW, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, VirtualQueryEx, WTSGetActiveConsoleSessionId, WaitForSingleObject, WaitNamedPipeW, WakeAllConditionVariable, WakeConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile, lstrcmpW
ole32.dll	CLSIDFromProgID, CLSIDFromString, CoAddRefServerProcess, CoCreateGuid, CoCreateInstance, CoGetClassObject, CoImpersonateClient, CoInitializeEx, CoInitializeSecurity, CoRegisterClassObject, CoRegisterInitializeSpy, CoReleaseServerProcess, CoResumeClassObjects, CoRevertToSelf, CoRevokeClassObject, CoRevokeInitializeSpy, CoSetProxyBlanket, CoTaskMemAlloc, CoTaskMemFree, CoUninitialize, CreateStreamOnHGlobal, IIDFromString, OleInitialize, OleLockRunning, OleUninitialize, StringFromGUID2
Secur32.dll	GetUserNameExW
WTSAPI32.dll	WTSEnumerateSessionsW, WTSFreeMemory, WTSQuerySessionInformationW
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, EnterCriticalPolicySection, LeaveCriticalPolicySection, UnloadUserProfile
COMCTL32.dll	InitCommonControlsEx, _TrackMouseEvent
WINHTTP.dll	WinHttpAddRequestHeaders, WinHttpCloseHandle, WinHttpConnect, WinHttpCrackUrl, WinHttpGetProxyForUrl, WinHttpOpen, WinHttpOpenRequest, WinHttpQueryHeaders, WinHttpReadData, WinHttpReceiveResponse, WinHttpSendRequest, WinHttpSetOption, WinHttpSetStatusCallback, WinHttpSetTimeouts, WinHttpWriteData
UxTheme.dll	SetWindowTheme
SHLWAPI.dll	PathMatchSpecW
ntdll.dll	NtDeleteKey
WINMM.dll	timeBeginPeriod, timeEndPeriod, timeGetTime
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW
api-ms-win-core-winrt-l1-1-0.dll	RoInitialize, RoUninitialize

Exports

Name	Ordinal	Address
GetHandleVerifier	1	0x4d79f0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T15:55:26.771372+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.6	49774	TCP
2024-11-01T15:55:48.258634+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.6	57376	TCP
2024-11-01T15:55:49.408023+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.6	57384	TCP

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 15:55:28.170046091 CET	53	51640	1.1.1.1	192.168.2.6
Nov 1, 2024 15:55:41.858015060 CET	53	61871	162.159.36.2	192.168.2.6
Nov 1, 2024 15:55:42.476671934 CET	53050	53	192.168.2.6	1.1.1.1
Nov 1, 2024 15:55:42.484972000 CET	53	53050	1.1.1.1	192.168.2.6
Nov 1, 2024 15:55:45.033510923 CET	61869	53	192.168.2.6	1.1.1.1
Nov 1, 2024 15:55:45.041007996 CET	53	61869	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 15:55:42.476671934 CET	192.168.2.6	1.1.1.1	0x8176	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 1, 2024 15:55:45.033510923 CET	192.168.2.6	1.1.1.1	0xe758	Standard query (0)	212.20.149.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 15:55:42.484972000 CET	1.1.1.1	192.168.2.6	0x8176	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 1, 2024 15:55:45.041007996 CET	1.1.1.1	192.168.2.6	0xe758	Name error (3)	212.20.149.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: dAYksbWyFS.exePID: 6236, Parent PID: 4004

General

Target ID:	0
Start time:	10:55:07
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\dAYksbWyFS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\dAYksbWyFS.exe"
Imagebase:	0x500000
File size:	4'962'863 bytes
MD5 hash:	18390350844942315DF7E588671B4B4E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: dAYksbWyFS.exePID: 6236, Parent PID: 4004COMMON

Non-executed Functions

Function 006E67AB Relevance: 46.7, APIs: 25, Strings: 1, Instructions: 1201COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 006E67F9
operator+.LIBVCRUNTIME ref: 006E6813
DName::operator+.LIBCMT ref: 006E6941
DName::operator+.LIBCMT ref: 006E695E

Part of subcall function 006E786D: DName::DName.LIBVCRUNTIME ref: 006E78B0

DName::operator+.LIBCMT ref: 006E6A12
DName::operator+.LIBCMT ref: 006E6A21

Part of subcall function 006E9B7C: DName::operator+.LIBCMT ref: 006E9BC0
Part of subcall function 006E9B7C: DName::operator+.LIBCMT ref: 006E9BCC
Part of subcall function 006E9B7C: DName::operator+.LIBCMT ref: 006E9C47
Part of subcall function 006E9B7C: DName::operator+=.LIBCMT ref: 006E9C8A

DName::operator+.LIBCMT ref: 006E69AD

Part of subcall function 006E4397: DName::operator=.LIBVCRUNTIME ref: 006E43B8

Part of subcall function 006E42FF: shared_ptr.LIBCMT ref: 006E431B

Part of subcall function 006E7A30: shared_ptr.LIBCMT ref: 006E7AD6

DName::operator+.LIBCMT ref: 006E6F8B
DName::operator+.LIBCMT ref: 006E6FA7
DName::operator+.LIBCMT ref: 006E7246

Part of subcall function 006E4482: DName::operator+.LIBCMT ref: 006E44A3

Strings

/, xrefs: 006E70EF

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: Name::operator+$NameName::shared_ptr$Name::operator+=Name::operator=operator+
String ID: /
API String ID: 848932493-2043925204
Opcode ID: 7166d04ca86f06f9b512fc4bfa17c7f03d7f3c9ef0536aa1caf471bdf8eefe2b
Instruction ID: 66fef7b9d9b7c09a860a5b42e14a5c77ecc4897037df0371a27bc620593bcb44
Opcode Fuzzy Hash: 7166d04ca86f06f9b512fc4bfa17c7f03d7f3c9ef0536aa1caf471bdf8eefe2b
Instruction Fuzzy Hash: 42928FB2E157999BDB14DEAACC95BEE77B6EB14340F14013DF502E7280EB28D909CB50

Function 007E4C80 Relevance: 16.4, APIs: 8, Strings: 1, Instructions: 604COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 007E4E07
__aullrem.LIBCMT ref: 007E4E19
__aulldiv.LIBCMT ref: 007E4E65
__aullrem.LIBCMT ref: 007E4E7A
__aullrem.LIBCMT ref: 007E4F09
__aulldiv.LIBCMT ref: 007E4F1C
__aullrem.LIBCMT ref: 007E4F2C
__aulldiv.LIBCMT ref: 007E4F40

Strings

genstalleer het. Jy moet al jou blaaiers herbegin voordat jy $1 gebruik.=, xrefs: 007E4EFA, 007E4F00, 007E4F14, 007E4F19, 007E4F24, 007E4F29

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: genstalleer het. Jy moet al jou blaaiers herbegin voordat jy $1 gebruik.=
API String ID: 3839614884-3165034908
Opcode ID: 16aeb1a6c256b901ed351aa2d8ee46bba5e3fb5c617f7ce87f936704cd1d079a
Instruction ID: 893bad2ad5009ed0e4225235c4f06f216e4cd374e11c78aa8d229da5e9cda636
Opcode Fuzzy Hash: 16aeb1a6c256b901ed351aa2d8ee46bba5e3fb5c617f7ce87f936704cd1d079a
Instruction Fuzzy Hash: 98224B7570164A8FCB18CE6DC890AAAB7E6EFCD300F19826DE945DB395D635DC01CBA0

Function 005D12C0 Relevance: 11.6, Strings: 8, Instructions: 1603COMMON

Download Yara Rule

Strings

79.0Main, xrefs: 005D22B2, 005D1DC3, 005D2428
D, xrefs: 005D26C6
79.0Main, xrefs: 005D12EA, 005D1798, 005D1389
base, xrefs: 005D13C7
tati, xrefs: 005D1647
on, xrefs: 005D163D
anno, xrefs: 005D166E
, xrefs: 005D1471

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: $79.0Main$79.0Main$D$anno$base$on$tati
API String ID: 0-1402783646
Opcode ID: 8ef78a655b807d90b38af8ac8de61dbbb785df25f9b34530c2dae7086e3c49bb
Instruction ID: 6b03d550b4dca6f7947fe53129df741ac963e7ce5a8c6f665f0393f67dfe6709
Opcode Fuzzy Hash: 8ef78a655b807d90b38af8ac8de61dbbb785df25f9b34530c2dae7086e3c49bb
Instruction Fuzzy Hash: 94D20671A087419BDB30DF28DC85BAE7BE5BF94304F44492FE88A87391EB71A944C752

Function 007E5300 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 388COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 007E5318
__aulldiv.LIBCMT ref: 007E5329
__aullrem.LIBCMT ref: 007E5337
__aulldiv.LIBCMT ref: 007E534A

Strings

genstalleer het. Jy moet al jou blaaiers herbegin voordat jy $1 gebruik.=, xrefs: 007E530F, 007E5315, 007E5321, 007E5326, 007E532F, 007E5334

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: genstalleer het. Jy moet al jou blaaiers herbegin voordat jy $1 gebruik.=
API String ID: 3839614884-3165034908
Opcode ID: c2debcc27df97a34ae02b971f9b19713b8aeee359aebf3f686ee169567c2a05d
Instruction ID: c9fba011664360097482197a0eed6ef52848c5f0c14a42fc7cbbd6f60fbedc97
Opcode Fuzzy Hash: c2debcc27df97a34ae02b971f9b19713b8aeee359aebf3f686ee169567c2a05d
Instruction Fuzzy Hash: 68D11536701A468FCB19CE2DC8909A9FBE6EF89300B598269E849DF356D635FD01C7D0

Function 007D7540 Relevance: 6.9, Strings: 5, Instructions: 606COMMON

Download Yara Rule

Strings

0.66, xrefs: 007D7998, 007D76BE
0.66, xrefs: 007D767D, 007D769D, 007D7681, 007D76A8
0.660.66, xrefs: 007D75DB, 007D764C, 007D76B4, 007D78D0
0.660.66, xrefs: 007D7B0A, 007D7B66, 007D7BE2, 007D7BC7, 007D770F
0.66, xrefs: 007D77CD, 007D7776

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: 0.66$0.66$0.66$0.660.66$0.660.66
API String ID: 0-2393938038
Opcode ID: 8ad9eb0c166b3aa4f82b42021ba6cb93d99056b146c6817428c58fac2d0e8409
Instruction ID: 0f563d35c88d73df5252967ea1b8f8efe1be3015ff8d71f3831b30f5a65ba08c
Opcode Fuzzy Hash: 8ad9eb0c166b3aa4f82b42021ba6cb93d99056b146c6817428c58fac2d0e8409
Instruction Fuzzy Hash: BB326175A047118FDB14DF28C884A6AB7F2FF88310B15866EE84A9B351E774EC41CF91

Function 005D5430 Relevance: 6.8, APIs: 4, Instructions: 802COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 005D5520

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: c268d2ea34bb185ec9f2209b2617115bf139f44a0780250cc53861f2f3e791cf
Instruction ID: c108b6a471fb1ec2885eb3ec5633b0bc54dbade62f9da9bf0035a45b5a86d703
Opcode Fuzzy Hash: c268d2ea34bb185ec9f2209b2617115bf139f44a0780250cc53861f2f3e791cf
Instruction Fuzzy Hash: E762C0B1600B418BDB31DB38C885BB6BBE5BF95304F04492FE89A87352EB70B945CB51

Function 005F93D0 Relevance: 6.5, APIs: 4, Instructions: 494COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 005F9531
_strlen.LIBCMT ref: 005F95A7

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: ___from_strstr_to_strchr_strlen
String ID:
API String ID: 1576176021-0
Opcode ID: 03cbec88260edd84eb1915eab54f063a83dc90996df924b12a7925ebaec82784
Instruction ID: ccfe2bf081dd0b855f327adb82acb2f734d92da3f9a658d940449cf5ccf9e9a4
Opcode Fuzzy Hash: 03cbec88260edd84eb1915eab54f063a83dc90996df924b12a7925ebaec82784
Instruction Fuzzy Hash: 2C12C2B4E046198FDF14DF68D8947BABBF6FF89304F188029DA05AB251D7389D42CB91

Function 005145D0 Relevance: 6.4, APIs: 1, Strings: 2, Instructions: 1130COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00514840

Strings

TA, xrefs: 0051473D
`PA, xrefs: 00514AB0

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID: `PA$TA
API String ID: 4218353326-1813173750
Opcode ID: 0072e65d9ca13fa14b3e7dc05ddb202b90e1bff46d1be908036e759ca93adabe
Instruction ID: 2540ed44420ad18921182bc3245adb4d1d1768a315aa3369e38c324ef6f1b2de
Opcode Fuzzy Hash: 0072e65d9ca13fa14b3e7dc05ddb202b90e1bff46d1be908036e759ca93adabe
Instruction Fuzzy Hash: A882D571A007119FDB10DF24C885BAEBBE6BFC4714F04492DF98997381EB74AD858B92

Function 00587420 Relevance: 5.0, Strings: 1, Instructions: 3785COMMON

Download Yara Rule

Strings

yn, xrefs: 005885C2

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: yn
API String ID: 0-4121978941
Opcode ID: ace83592128540aba79621b4c5d436f4e6cf75c596b6cebe7cd6262f90aaf38c
Instruction ID: 3cb09f7b65c8e27eca1626aa4610bb46cb3ef7dfb9e509f64afdad47f668ac2f
Opcode Fuzzy Hash: ace83592128540aba79621b4c5d436f4e6cf75c596b6cebe7cd6262f90aaf38c
Instruction Fuzzy Hash: 3753F671A002159BDB10EF60CC4AFBE7BA5BF89744F44806CF94977292DB34AD45CBA2

Function 0051E710 Relevance: 4.7, Strings: 3, Instructions: 990COMMON

Download Yara Rule

Strings

, xrefs: 0051E851
`A, xrefs: 0051E8E0
, xrefs: 0051F16A

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: $ $`A
API String ID: 0-3285760736
Opcode ID: bcbadb5c7430defb829496dc8eae25d23e2cbe09cb0be0b3bb25801f8e05ca95
Instruction ID: ceb2783bd44b7d618bf019f6e39de7a357b0dbe6041072ab32057f5455278b44
Opcode Fuzzy Hash: bcbadb5c7430defb829496dc8eae25d23e2cbe09cb0be0b3bb25801f8e05ca95
Instruction Fuzzy Hash: 1C720A75A003159BEB24EF10DC46BEA7B65BF44714F04456DED0AAB282EB70AEC4CBD1

Function 0053A240 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1123COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0053A341

Strings

$, xrefs: 0053A5B5

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID: $
API String ID: 4218353326-3993045852
Opcode ID: 5a6e3504b7de80752540da2ae64f07959a5f85452fb42a082a71da0f32a777b2
Instruction ID: 2ecc34f4467ee506042de94174233528f66538325428b34bbacfd377a7d4ecec
Opcode Fuzzy Hash: 5a6e3504b7de80752540da2ae64f07959a5f85452fb42a082a71da0f32a777b2
Instruction Fuzzy Hash: CE92C371E0061A9FDF14DF64C895AAEBBB6FF48300F14456DE849AB241EB30ED45CB91

Function 0053F020 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1115COMMON

Download Yara Rule

Strings

08C, xrefs: 00540E90

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: 08C
API String ID: 0-593530963
Opcode ID: 3b0b9b837892a586400363eddff6473881c7b04d9a88977cec0f025d443af4df
Instruction ID: ce0ba4b0f56dadd398c72e9bfec5de2ee77865203b70144f21a2ab9b7c697996
Opcode Fuzzy Hash: 3b0b9b837892a586400363eddff6473881c7b04d9a88977cec0f025d443af4df
Instruction Fuzzy Hash: 4492A1B1D002189BDB24DF64CC41BEEBBB5BF88704F14456EE959A7281E730AE85CF91

Function 00523340 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1096COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0052336F

Part of subcall function 005244C0: _strlen.LIBCMT ref: 005244EE

Strings

alue, xrefs: 00523E1B

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID: alue
API String ID: 4218353326-2357421402
Opcode ID: e89f088cc79553d99a2b979e58c040c2507d195133ec7f737181aa0323275cf5
Instruction ID: c6f2f794ec31f338691a7adbccb7d199e4ab14d65145053a04fe53a7c26eb3c2
Opcode Fuzzy Hash: e89f088cc79553d99a2b979e58c040c2507d195133ec7f737181aa0323275cf5
Instruction Fuzzy Hash: 26926C71A04361AFCB10DF14D484A6BBBE5FF86714F054A1DF889972C2E738EA45CB92

Function 00654CE0 Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

!X[, xrefs: 00654DE4
!X[, xrefs: 00655185, 006551A5, 00654E0D, 00654EDC, 0065501E, 00654E2F, 00655166, 00654FFA, 00654F11
!X[, xrefs: 00654CEC, 00654D79, 00654D67, 00654D42, 00654D18

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: !X[$!X[$!X[
API String ID: 0-1438489014
Opcode ID: b70d659b51e686433d6252fd3bcf89bf2d0767774e6abd8c0442d46c945e940f
Instruction ID: 1c6068869aab3ec3b0ffccdf556537c648699a7a5092f8773ba4202a21440aad
Opcode Fuzzy Hash: b70d659b51e686433d6252fd3bcf89bf2d0767774e6abd8c0442d46c945e940f
Instruction Fuzzy Hash: 17E10471A006168FCB14CE58C4907BEBBF3EF85355F24456ADC56AB381DB30AD8ACB91

Function 00677210 Relevance: 3.5, APIs: 2, Instructions: 486COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00677555
__floor_pentium4.LIBCMT ref: 00677769

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 596826027010dd9e21224482abdca2d0889419ee142e642c80aeb21653f623b3
Instruction ID: eb3d7d9a38c97471e696a13fc18dd7af94c1c4f53d3ee9d33846634e78b89b32
Opcode Fuzzy Hash: 596826027010dd9e21224482abdca2d0889419ee142e642c80aeb21653f623b3
Instruction Fuzzy Hash: 43F1D631B186058BCB19CF68D89157EB7F3BF88310718C629D81AE7351EB31E882CB91

Function 006802C0 Relevance: 3.3, APIs: 2, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d42162624d5c5ccd27a76ada84ac106aa4f182f775feab0acf52f5163e245133
Instruction ID: 509e6f9aa151e17cb1eb8a068d91e8b4702e26b097eb0bede43c3f4d41b0d73c
Opcode Fuzzy Hash: d42162624d5c5ccd27a76ada84ac106aa4f182f775feab0acf52f5163e245133
Instruction Fuzzy Hash: AF91F231A146168FDB45EF39C98056EF7F3AF89310728CB2AD846EB351E730E8858B51

Function 0064C330 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0064C3FB
__aulldiv.LIBCMT ref: 0064C491

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: dc7411e2d2dc494ea33a6606b4211522b0869bddaa9a9d6f445e020b57f27f5c
Instruction ID: 078e103f454b68d37ea521c572a69088e814de74089ee11b00bd52c31d54f09b
Opcode Fuzzy Hash: dc7411e2d2dc494ea33a6606b4211522b0869bddaa9a9d6f445e020b57f27f5c
Instruction Fuzzy Hash: 31619F727052004BC748DE7CC89176AB6DBABC9730F294B2DB56AC73E0EE70DD058655

Function 0052CB90 Relevance: 3.1, Strings: 2, Instructions: 584COMMON

Download Yara Rule

Strings

rver, xrefs: 0052D4F9
ySer, xrefs: 0052D500

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: rver$ySer
API String ID: 0-655020459
Opcode ID: f26327926588113ae6412982de7781a926d18a7e7ef8f236be68f53391d2286f
Instruction ID: ca13750950293c9b445ae4d8e714e811f391135c74d44a425218788e09f67759
Opcode Fuzzy Hash: f26327926588113ae6412982de7781a926d18a7e7ef8f236be68f53391d2286f
Instruction Fuzzy Hash: 4BE1E5B19412189FCB44DF58DC85AAEBBF5FF45304F14802DE808AB381EB74AA44CBE5

Function 00583540 Relevance: 3.0, Strings: 2, Instructions: 499COMMON

Download Yara Rule

Strings

v.X, xrefs: 00583A1B, 00583AA1, 00583A87, 00583A04, 00583889, 005838C5, 005837C6, 00583856, 00583680, 00583787, 00583761, 005836EC, 005835DA, 00583651, 005835A8, 0058371B, 00583A07, 00583A8A
v.X, xrefs: 00583569, 0058378D, 00583754

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: v.X$v.X
API String ID: 0-915023426
Opcode ID: 34cb0159ed24edbd374bfb0a459d5be243cc3e91c09eb88baa7f5029e2db5130
Instruction ID: a9232a9825ad591ed7ea22ffd3cacaac380380e23dd05bdab3b3536ad41b5dc5
Opcode Fuzzy Hash: 34cb0159ed24edbd374bfb0a459d5be243cc3e91c09eb88baa7f5029e2db5130
Instruction Fuzzy Hash: D4227575E0060A8FCB14DF68C881AADBBB1FF99714F148259D815BB351E770EA85CBA0

Function 005D4910 Relevance: 2.9, Strings: 2, Instructions: 377COMMON

Download Yara Rule

Strings

)ww, xrefs: 005D4919, 005D4D0B, 005D499C
8ww)ww, xrefs: 005D4AC4

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: )ww$8ww)ww
API String ID: 0-2513910925
Opcode ID: e97cd18da76d20906e6cd9126842e7aa5e388c5126beeab07df7ea269dff90e0
Instruction ID: d3daec6498dd5ab13326df41cff407e9dffafced407f929f29cda9f8c3b26f79
Opcode Fuzzy Hash: e97cd18da76d20906e6cd9126842e7aa5e388c5126beeab07df7ea269dff90e0
Instruction Fuzzy Hash: C8E11635E016018BCB2DCF6CDC919B97BB6FF88304B15862FE84697391E731A981CB52

Function 0065A410 Relevance: 1.9, Strings: 1, Instructions: 636COMMON

Download Yara Rule

Strings

Yh[, xrefs: 0065A9E2, 0065A59B, 0065A9E8

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: Yh[
API String ID: 0-3450971646
Opcode ID: 9d0545b3a668f640d8ee6f7c7b038a2b9dca23b08deff908f36c217d2416aaf7
Instruction ID: a18e93f070254cee8f43e35724fedd1f3c460f1514cc6bc2924dbfd64ff85e58
Opcode Fuzzy Hash: 9d0545b3a668f640d8ee6f7c7b038a2b9dca23b08deff908f36c217d2416aaf7
Instruction Fuzzy Hash: 9E32C571A002598FDB19CAE4C8D4AFDB7B7BF45301F28425ADC12A7391E7349D8ACB42

Function 0065E440 Relevance: 1.9, APIs: 1, Instructions: 354COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0065E471

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 6438ec9a6c7fd523200a09da5d1768685df10ef88ba1c3a77fefae62f94932e4
Instruction ID: a2e0f4dd542f9d8520ab898dd1d3f2f426841a6294d8d12b5bc8fcb91f0f865f
Opcode Fuzzy Hash: 6438ec9a6c7fd523200a09da5d1768685df10ef88ba1c3a77fefae62f94932e4
Instruction Fuzzy Hash: 58C19F75E002159FCF18DFA4D8849ADB7B7BF88311F148169EC15A7341EB32AD0ACB90

Function 005FC4D0 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b122dbafd376ecc920aa0f3b1854ee53fd81fe7f5b90a9cb483821bc9eed60
Instruction ID: e3327b915ef189b80f9353cb6b101f391914f7098de137fafce7476241ba129f
Opcode Fuzzy Hash: c2b122dbafd376ecc920aa0f3b1854ee53fd81fe7f5b90a9cb483821bc9eed60
Instruction Fuzzy Hash: B971B5B2E00E184FDB0BDA3A9D05356F6A7EFE57C0F04C727A81BB2151DB385C668A45

Function 00675280 Relevance: 1.7, Strings: 1, Instructions: 427COMMON

Download Yara Rule

Strings

genstalleer het. Jy moet al jou blaaiers herbegin voordat jy $1 gebruik.=, xrefs: 00675691

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: genstalleer het. Jy moet al jou blaaiers herbegin voordat jy $1 gebruik.=
API String ID: 0-3165034908
Opcode ID: 6e6a7f2931ac5f374cabff2886ee5befc8b97235f467acb0ea367fba908372cf
Instruction ID: d7f0e3d6409d105aa1fc3a31855f847ed7aeed33b2629b6f9f02c88c3178f2ae
Opcode Fuzzy Hash: 6e6a7f2931ac5f374cabff2886ee5befc8b97235f467acb0ea367fba908372cf
Instruction Fuzzy Hash: 04F1B170604740CFD718DF28D845BAA77E2BF94321F14C6BDE49B87391E7B4A8868B52

Function 005E33A0 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 005E34D9

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 5698c02d1f9b95217f085a5867fe464ceb0591a02e540aeeb3cfb3ae28b8ebc3
Instruction ID: 65832ff260c64b241b87d0990be1080275d25fd98576f1c26e8415a78f14086a
Opcode Fuzzy Hash: 5698c02d1f9b95217f085a5867fe464ceb0591a02e540aeeb3cfb3ae28b8ebc3
Instruction Fuzzy Hash: F451B4B5B001458BCF18DF29E8595AA7BAABFC4300B55412DE9469F386DB30FE21CBD1

Function 0060AEA0 Relevance: 1.6, Strings: 1, Instructions: 366COMMON

Download Yara Rule

Strings

\Tw, xrefs: 0060B2B1

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: \Tw
API String ID: 0-2320593417
Opcode ID: b08ca7c65fbeecddd281d458475bde8aa55b4c1dc62b2802906f1beaf5360e39
Instruction ID: b4a209546523644a0172061f1cffb1fa001f481e81db73d7ba0de5268be368a7
Opcode Fuzzy Hash: b08ca7c65fbeecddd281d458475bde8aa55b4c1dc62b2802906f1beaf5360e39
Instruction Fuzzy Hash: A1D1B3B0A043058BCB18DF28D4956ABB7E6BFC4300F14866DE8468B385EB70ED55CBD2

Function 00746080 Relevance: 1.5, Strings: 1, Instructions: 299COMMON

Download Yara Rule

Strings

0, xrefs: 00746436

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e3b8499d7c053b2bfb942e20467eea8fedd9be337bf0418d17da7f3c0f0c6cb2
Instruction ID: 0bf5b9e98e31796af6a7d8b5770107c57075840ef5695462f875a9525bb15752
Opcode Fuzzy Hash: e3b8499d7c053b2bfb942e20467eea8fedd9be337bf0418d17da7f3c0f0c6cb2
Instruction Fuzzy Hash: CBD1A271D18FC687E7139B3D88432A6F3A0BFEA254F10DB1AECD076552EB7466858381

Function 0076AD74 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

@, xrefs: 0076B016

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 7209f891c392bef25ac86d1d8fc3dc5e17db9caa00ed3ca0907fe115626d9ac9
Instruction ID: a00d773546e9485a48d453f298ac0fc30ac24f768e456896a0ce3ca591bea822
Opcode Fuzzy Hash: 7209f891c392bef25ac86d1d8fc3dc5e17db9caa00ed3ca0907fe115626d9ac9
Instruction Fuzzy Hash: E5A13871B046866BCB158938C855B6EBBE29B95314F18832CEC57EB7C2D778AC04C792

Function 0076AD60 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

@, xrefs: 0076B016

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: bd78efe9f96d4699df79768316c6a9b03cc757fd3ecad939f1ded1ce6488d0f8
Instruction ID: 09a3df3eac9e6bdbedc02215111fdde25b23e2f198365d26d07cf1c44a1b1804
Opcode Fuzzy Hash: bd78efe9f96d4699df79768316c6a9b03cc757fd3ecad939f1ded1ce6488d0f8
Instruction Fuzzy Hash: 47914871B046866BCB158978C855B2EBBE2AB85314F18473CEC57EB7C2D778AC04C792

Function 0076AD68 Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

@, xrefs: 0076B016

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: d88342b3f98b64e36625f6a53ff6b78945ea0af3d78cfc32c5118113ce2e0b11
Instruction ID: a3d0a462e562e1c33fe863c4035882f90cf404ead13086ed5744d7a9a35c153a
Opcode Fuzzy Hash: d88342b3f98b64e36625f6a53ff6b78945ea0af3d78cfc32c5118113ce2e0b11
Instruction Fuzzy Hash: 49915971B046866BCB158938C855B2EBBE29B95314F18473CEC57EB7C2D778AC04C792

Function 005F6810 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

SQ, xrefs: 005F6821

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: SQ
API String ID: 0-3028818898
Opcode ID: d8490ef554d4b18910df58a7e361b22eb37be5ee32120309e11aafa367eb8908
Instruction ID: 7b13123b9b5c723a6db7b8e2f3c85dec8a076468bf52dbe144f16238dacc5974
Opcode Fuzzy Hash: d8490ef554d4b18910df58a7e361b22eb37be5ee32120309e11aafa367eb8908
Instruction Fuzzy Hash: 6F91D4716083459FD715DB24C851BBFBBE5BFC8704F044A2DEA89D7241EB39EA048792

Function 0074AFE0 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

l6\, xrefs: 0074AFE0

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: l6\
API String ID: 0-1431136252
Opcode ID: 2d4b7c86401d74f7213dde90f5cd11574a821dc645e365eb351548680864b834
Instruction ID: fed475f91f1fb53fd82652af435ae214d6f66339ea708159cced234a11d67e36
Opcode Fuzzy Hash: 2d4b7c86401d74f7213dde90f5cd11574a821dc645e365eb351548680864b834
Instruction Fuzzy Hash: 7691D075A002059FDF14CEA8D8C4AAFB7B6FF88350F148528E815AB361E735DD55CBA0

Function 0076AD7C Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

@, xrefs: 0076B016

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 540f257fe1e828942c6d4dd75116ce5cc0ada446adb5b15660b8a8b0291195e9
Instruction ID: dd6f1751e43a0946391dc7cc4096f2d54d40d2f744ae889b3de802e79c5cb4e3
Opcode Fuzzy Hash: 540f257fe1e828942c6d4dd75116ce5cc0ada446adb5b15660b8a8b0291195e9
Instruction Fuzzy Hash: D5914871B046866BCB158978C855B6EBBE29B81314F18473CEC67EB7C2D778AC04C792

Function 0061CA20 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

gfff, xrefs: 0061CA3A

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 9d20d20dc809d9fab7b4ef70d82f6fe59012536b320a3f6b80ed7415ec9f83a7
Instruction ID: ea2774471956511adef0c7b29d3e4dc2f03829aa42e6400177774949de606cb5
Opcode Fuzzy Hash: 9d20d20dc809d9fab7b4ef70d82f6fe59012536b320a3f6b80ed7415ec9f83a7
Instruction Fuzzy Hash: 9E91E3B6A047159FD704CF2DD89065ABBD2AFC9360F18C62DE869CB3A1E630DD41CB81

Function 0061C710 Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

gfff, xrefs: 0061C72A

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 4af996d39d8d677b0ca46d5a27c2cb4d7b754437785000ff02e3de4d39795f69
Instruction ID: 1743b415fe43d1555ddcf7be8b3f21f454f09568d7f89cff82c0077ab0cdb5d7
Opcode Fuzzy Hash: 4af996d39d8d677b0ca46d5a27c2cb4d7b754437785000ff02e3de4d39795f69
Instruction Fuzzy Hash: 8291D576A047159FD704CF2DC89025ABBE6AFC9360F19C62DE469CB3A1EB30D9458B81

Function 007825F6 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

, xrefs: 00782698

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d1cf03ed789647111dcfcad8ca8449575ed26b991cc081a59bd403234d8ad578
Instruction ID: 996cb494e0628ed05ea7f38643ace7b1bd6b83e3b7eb898d25cf3176dfd0f61b
Opcode Fuzzy Hash: d1cf03ed789647111dcfcad8ca8449575ed26b991cc081a59bd403234d8ad578
Instruction Fuzzy Hash: EF515B71B042859BCB15DA78C894B3EB7E2EBD5314F28826CE956DB7C3D638AC02C350

Function 007825C6 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

, xrefs: 00782698

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: eee32f94a3c1e19383b7bcf4a9e4bb259ab8fa87b4a0c0488f1c84a6367f8e33
Instruction ID: 4b3b98a8b3fc890dd4a1234a6475cb4fcf3b1aa3fef42da6f16bdb8d9003ca47
Opcode Fuzzy Hash: eee32f94a3c1e19383b7bcf4a9e4bb259ab8fa87b4a0c0488f1c84a6367f8e33
Instruction Fuzzy Hash: 6A514971B453825BC7199978C894B2EB7D2EB95314F28827CEA56CB7C3D638EC06C390

Function 0061AA00 Relevance: 1.2, Instructions: 1243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf138490865f77cbc08530be22a8d06633f6a7df61ef69737647f2d9935c18db
Instruction ID: d9cb4ec5074c0ddf27048ddfdbf712410bc214e7c06172d960911cf2920d5af0
Opcode Fuzzy Hash: cf138490865f77cbc08530be22a8d06633f6a7df61ef69737647f2d9935c18db
Instruction Fuzzy Hash: F2A2C176A093119FD718CE28C4907AAB7E3BFC9350F199A2DE89597390D730DC85CB82

Function 00644AB0 Relevance: .7, Instructions: 713COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5779d1d1f3834ab943a72af20cf02c284fcd178ffdf67486b9393b5fd982f8
Instruction ID: 61735c7c5ccdd82a37ade945b23c91e3cf3179bbe205da1590acd22c0ac5805e
Opcode Fuzzy Hash: 4b5779d1d1f3834ab943a72af20cf02c284fcd178ffdf67486b9393b5fd982f8
Instruction Fuzzy Hash: 5522B031B416270BCF2CC92D8CE52AEB293ABD8204B28D576E40AD775EFE70DD498754

Function 0067EBF0 Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c6bbb28f4936ccedb3632ce05592242be66be148311953dddc7fe99c6e31fc
Instruction ID: 974484d80a0f3a2f080813123ff83c89626c9c6113cd3da4eb0ba6f6311fb54e
Opcode Fuzzy Hash: 50c6bbb28f4936ccedb3632ce05592242be66be148311953dddc7fe99c6e31fc
Instruction Fuzzy Hash: DB426075A00215DFCF15CF64D490AAEBBB3BF49310B29C4A9E819AB352D731ED46CB90

Function 00806E20 Relevance: .7, Instructions: 662COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f5e2c19eb5a1182434162fdedaaf309b9a9890f6364cfbd206e140f2f6493c7
Instruction ID: c6a26c52a3b5f3d68f8c511d2868585deaf499301690480cd51f0d9358eec460
Opcode Fuzzy Hash: 5f5e2c19eb5a1182434162fdedaaf309b9a9890f6364cfbd206e140f2f6493c7
Instruction Fuzzy Hash: ED328EB2E1451A8FDF55CE6CCC806ADB7B6FF99310B294278E911EB394D734A901CB90

Function 007128C0 Relevance: .6, Instructions: 641COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca3df186f0f692d68948c3c11b97d29edfc4c5e94d71483f81524c1a49b70c19
Instruction ID: 58a60e869d13bcec76bf93cc3315fe25d3388bf069e2d6dfc7c7e48389f57c2e
Opcode Fuzzy Hash: ca3df186f0f692d68948c3c11b97d29edfc4c5e94d71483f81524c1a49b70c19
Instruction Fuzzy Hash: 3F4271B1D0022A9BDF25DB24DC49BEEB7B9AF55304F0041E9E509A6182EB746FC5CF90

Function 00698A80 Relevance: .6, Instructions: 622COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df81a72ae187882685e040370c6689504a2b0524bcae92f21170955ac8a70e5a
Instruction ID: 1c17c005012a64e7caea4bd0f24f20c67cd0d53a8c7925a0efbd1fdd23d8512e
Opcode Fuzzy Hash: df81a72ae187882685e040370c6689504a2b0524bcae92f21170955ac8a70e5a
Instruction Fuzzy Hash: 02429F71E042598FDF20CF68C8847ADB7B6BF46314F28825DD855AB742DB31AD46CBA0

Function 0067B0C0 Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c01a3f2b4f28c5e124e8d7aaf9b4ecefe01bc94bde6ab0b3f9d69e3f8bbc84
Instruction ID: e2902f2ab3883da090cb144eab18652cdbb49ce97629fe82d7a6be232fcd7d62
Opcode Fuzzy Hash: 21c01a3f2b4f28c5e124e8d7aaf9b4ecefe01bc94bde6ab0b3f9d69e3f8bbc84
Instruction Fuzzy Hash: CD3230B4E00209DFDF18DFA8E8D4AEDB7B6BB88314F149129E506A7351EB30AD41CB51

Function 005E2A20 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: b307fbcbf13cc430523e021bcd5588ac05a050f32a9fcd0fbb763a6f5d6ee968
Instruction ID: 0a93dd82ca50f581002e830d1538488eb142e210968f87ff036bfe097bef550e
Opcode Fuzzy Hash: b307fbcbf13cc430523e021bcd5588ac05a050f32a9fcd0fbb763a6f5d6ee968
Instruction Fuzzy Hash: 19221674E002458BCF18DF5AD859AEEBBB6BF84300F14412CE946AB346DB71ED15CB91

Function 005FAB50 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9e6b3813dc7d842ef33880fa51e386f870b1a3a7d43a88e9ce6d5384e2e93f
Instruction ID: ef4e11df656f2635e6dfed2f427bc04cb13799f0b9303065739e5731b4d3d6b1
Opcode Fuzzy Hash: aa9e6b3813dc7d842ef33880fa51e386f870b1a3a7d43a88e9ce6d5384e2e93f
Instruction Fuzzy Hash: 5B1297B1E003099BEF20DF64DC4AB7ABBB5BF44304F044569FA49A7252E774AD44CB62

Function 0064CFF0 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0486f3dd14483dac8b04bab9255d223087df569fc759e88a424a26c24ed0bf8d
Instruction ID: 945305471d013439b3d13c13b192f896b5b7b6afd37514056feacb2e6e39c7d8
Opcode Fuzzy Hash: 0486f3dd14483dac8b04bab9255d223087df569fc759e88a424a26c24ed0bf8d
Instruction Fuzzy Hash: 6F228E719047419BD364CB24D88ABEBB7E9AFD9310F10492DE9DAC7241EB70A584CB92

Function 0074C970 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66cd8492dcc7786830ab3b0a48e0ac37076a68e5fb3b8ba827bab40010f206f3
Instruction ID: 522bf71afbf6661a4b791b6ea8aa0262f540b560566e8aebe1a293522d1e5cc7
Opcode Fuzzy Hash: 66cd8492dcc7786830ab3b0a48e0ac37076a68e5fb3b8ba827bab40010f206f3
Instruction Fuzzy Hash: FB328F759097818FD376CF248845BEBBBE4AF99300F14492DE9DEC3242EB749584CB62

Function 00748AA0 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ae215354bf531b455f8b4d9a661190c9e4afe568ca2b91a2f59f256bdf2af4
Instruction ID: 6146ca181c777258ab2c13ad5533d15ccae36fa87f360bba73c735d99baa4493
Opcode Fuzzy Hash: 76ae215354bf531b455f8b4d9a661190c9e4afe568ca2b91a2f59f256bdf2af4
Instruction Fuzzy Hash: 3212C0B2E0020D9FDF50DFA4DC85AAEB7B9FF48304F144129E915AB241EB35E915CBA1

Function 00660000 Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e132461091fe540bf3301e5e1811b90ef08ed7035fb82d1b98a37697a3c4269c
Instruction ID: 4e36f173e687e83990e76a54457addb541da614697815d1334d25f812942e171
Opcode Fuzzy Hash: e132461091fe540bf3301e5e1811b90ef08ed7035fb82d1b98a37697a3c4269c
Instruction Fuzzy Hash: 8222D271D006199FEF14CF68C990AAFBBB7AF99304F14813DE406A7251EB31AD55CB90

Function 00713320 Relevance: .5, Instructions: 538COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4694ec9910547af32353f0c3fa8e764d70303acf6f828af9836b01f577624c67
Instruction ID: 0a21069e0d3171b94aa75363edcedbaa01b1e6ef9e5202088442b3cab7f3240a
Opcode Fuzzy Hash: 4694ec9910547af32353f0c3fa8e764d70303acf6f828af9836b01f577624c67
Instruction Fuzzy Hash: 17228EB1E052698BDF609F288C8C7D9BBB5AF44304F1442D9E84DA7291EB799EC4CF50

Function 005E3590 Relevance: .5, Instructions: 538COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf2bfcda3d7e1a14a8e08fef5de281a1b711f7eedeb69c0306dcc43ced811f2
Instruction ID: 42733e7542f5fe4ac846a9eaa1ef983c3a4ab24c77ad0c1005842560358d6718
Opcode Fuzzy Hash: 2bf2bfcda3d7e1a14a8e08fef5de281a1b711f7eedeb69c0306dcc43ced811f2
Instruction Fuzzy Hash: AA128274600B419FC728DF39C488A66BBE5BF89310F148A2DE8DA87751DB30F945CB91

Function 0058C420 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84faf585d007202e877e20dfde6358e79b366d3eab85ce0c0a4081b66aa38740
Instruction ID: d22b379cd57185d60ec9e59593f42c7600dc473c3a4bb19c63e81792bf71e181
Opcode Fuzzy Hash: 84faf585d007202e877e20dfde6358e79b366d3eab85ce0c0a4081b66aa38740
Instruction Fuzzy Hash: 440238B19002199BDF24EFA8D889AAEBFB5FF48750F144429FC01BB290E7759D45CB60

Function 007A10DA Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b35f73106e6c05246a48c815266958166df4984658ddf686587b577b676265
Instruction ID: 68289b764ea658c7453a8691ee2cc81b82f739340e7657197be8b58dbacb133c
Opcode Fuzzy Hash: 31b35f73106e6c05246a48c815266958166df4984658ddf686587b577b676265
Instruction Fuzzy Hash: 7E0209B3A125054BE7188A18C891B72B7D6FFE2360F5E436DC463CB3A2EE79D851C640

Function 00664980 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8a82422788b5b75023c201f71e82f22bc6d73ee552e21329b9ea9042ed769bc
Instruction ID: 9fd75d1c794edb98464e58e0839b5fc6a64a4264152b89e779f09e650eaa7caf
Opcode Fuzzy Hash: d8a82422788b5b75023c201f71e82f22bc6d73ee552e21329b9ea9042ed769bc
Instruction Fuzzy Hash: 2C026C70A00216DFDB14DF58D885BAEB7B3FF88314F148169E815AB391EB32AD51CB91

Function 00683170 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d6bfeac6d904b49427b1ea82ce4b75f5df3fb9f80dbd09366aac636c3b31a0
Instruction ID: 46909caab9759f25f3ccc91d62e22827a2aa2a10b77fd7801ded2ffba2ca3b6b
Opcode Fuzzy Hash: 19d6bfeac6d904b49427b1ea82ce4b75f5df3fb9f80dbd09366aac636c3b31a0
Instruction Fuzzy Hash: 92020371A002299FCF259F24CC90AEDBBB3BF89710F148299E95997352D7359B85CF80

Function 0080C070 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba698fa7619ae9680fb4722694260ffda328fb8ab21fe0efa43420557917a31c
Instruction ID: 8efc74d05022b689642528db0373979259ba178cec2054e708f00996b5f5aee2
Opcode Fuzzy Hash: ba698fa7619ae9680fb4722694260ffda328fb8ab21fe0efa43420557917a31c
Instruction Fuzzy Hash: 7C02B171E002198BCB64CF98C8815BEF7B2FF98310B698769C815EB385E771AD45CB94

Function 00504A80 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0143fbb01e4cb802368a0b9f9344aaf815a2c6f2a28245d16c8935a4c8e93d81
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 0143fbb01e4cb802368a0b9f9344aaf815a2c6f2a28245d16c8935a4c8e93d81
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Function 0056B1C0 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92477960eb0d00212870464c9340dd0e97b16034584467ef7617fd490185a2a0
Instruction ID: 28f47e864b4e24af39c6b7bc083c408fc6eda03074ba0d8abba13be5fb220ba2
Opcode Fuzzy Hash: 92477960eb0d00212870464c9340dd0e97b16034584467ef7617fd490185a2a0
Instruction Fuzzy Hash: 3FF117B0A02A068BDF14DB68CC597BEF7A2BF84325F14459DE519AF392CB749D808B44

Function 0085D510 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6badb9b709382ad93ca96983ec832ccedd8373398523ae94020fdf2fc5f7487b
Instruction ID: 72947a7805df46f99c27aa0f63f4d7ee594da38e88bdbe7bbfdef71e605a3c83
Opcode Fuzzy Hash: 6badb9b709382ad93ca96983ec832ccedd8373398523ae94020fdf2fc5f7487b
Instruction Fuzzy Hash: 84F16075A0021A8FCF28CF58C891AAEB7B2FF98315F258129EC15E7390D774AD55CB90

Function 007A120E Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95fdfc1f5c6cf3f2371911156f4a39ea024727c9ddf8c6bebbe86797166f14d0
Instruction ID: 579afe66c03b5e7b5f76f9ecece124b7ad22c17725166551f185c8fdbc74569a
Opcode Fuzzy Hash: 95fdfc1f5c6cf3f2371911156f4a39ea024727c9ddf8c6bebbe86797166f14d0
Instruction Fuzzy Hash: FFE1FDB3A125054BE7188768C891BB277D6BFE2360F6E436DC467CB3A2DE78D451C640

Function 007A10B0 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187419cc5915e6e0331a814c5f135fec5eb14d5e126fba42836c03ca20043772
Instruction ID: b859fd258220833d5e98b5d0453b2c8558d6bc71c5dbe32b198a84814e348802
Opcode Fuzzy Hash: 187419cc5915e6e0331a814c5f135fec5eb14d5e126fba42836c03ca20043772
Instruction Fuzzy Hash: E3E1F973B016454BFB1C8A18C891B72B792AFE6360F5D836DC866CB3A2DA7DD851C640

Function 006309F0 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6264ceda393d6a52334a2604780a778907c9b6cf034ee16a213ab95e8495f8f7
Instruction ID: 16bfa1dae5303b1924d3eb898ee5bf372d088d48c67874745dc88e24f13481f6
Opcode Fuzzy Hash: 6264ceda393d6a52334a2604780a778907c9b6cf034ee16a213ab95e8495f8f7
Instruction Fuzzy Hash: F6F17F70B0421A8BEB78CE18D9A17BDB3A2FB48314F1541BDD81A97781D7749D8ADF80

Function 00716AD0 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: ac864b1d76abac451c36e73033616d85dcda05af9ecbc9076b7cd114b6a47dce
Instruction ID: 1b49d9b2f71c8fd2a197e3e3c907970471025413d717b8b839457b00aebd78e6
Opcode Fuzzy Hash: ac864b1d76abac451c36e73033616d85dcda05af9ecbc9076b7cd114b6a47dce
Instruction Fuzzy Hash: 42C1B6B5A00618ABDF14DFA8DC81AEFB7BAFF44700F14851DF915A7281E734A944CBA4

Function 00748520 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be033bbd4a3b8c7a39cbedfb2bf600f39d51393c7981d463555ff1e567d2e21
Instruction ID: 3f1ec05818e14254ae0dd75798dd68b91cb296017b7b298beea5a03ccdb8f936
Opcode Fuzzy Hash: 3be033bbd4a3b8c7a39cbedfb2bf600f39d51393c7981d463555ff1e567d2e21
Instruction Fuzzy Hash: 35F161B1A0016A8FDF64DF14CC80BAEB776FF84304F1441AAEA19A7241DB349E95CF59

Function 0070E460 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bc8999d31bd702ecae49d9d278e8348b5f981fb82b7667f4a082407ce5054c
Instruction ID: 34bd714e3bc7a9df689ce231761d313544811d51cad07855093a5ec3682d4152
Opcode Fuzzy Hash: b2bc8999d31bd702ecae49d9d278e8348b5f981fb82b7667f4a082407ce5054c
Instruction Fuzzy Hash: 98F1C2B1E01755CBDB248F28CC58BADB7B5BF85310F14479DE449AB392DB789980CB90

Function 005C3460 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd563bf852eedf64c7a435c6dbb50a041e20250dae80851cbc07b526f1266bb
Instruction ID: d42dc3b3b32b8522969a619b6d94033384cede793c225558ee82c452e6a4599f
Opcode Fuzzy Hash: 6bd563bf852eedf64c7a435c6dbb50a041e20250dae80851cbc07b526f1266bb
Instruction Fuzzy Hash: E9D106B1D0020DEFDF149BA0DC46FAE7B79BF44308F048469E909AA192E775DB94CB91

Function 00668790 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f70e3c7ce3181b1cae0d4107232913ac20c253dd652fc8f00886f05ce02146
Instruction ID: d4f7b01d905578a97a7cd411bdff5f0cabb9896a716b40316f0cbd7b09cb44d3
Opcode Fuzzy Hash: c9f70e3c7ce3181b1cae0d4107232913ac20c253dd652fc8f00886f05ce02146
Instruction Fuzzy Hash: 3DE19472E504564BDB48CF69DC6067AB7B3FBC9310F2A813DD602A73D1CA38A902CB54

Function 00618980 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a3d1f3fba47da1ffe6a1efd47f70ed371d5d0c755dffbcd21c36b999de7be4
Instruction ID: c32ac1ecc6f5ac334707118e17548f6d6057e401db8f611713dffebe94ad30c4
Opcode Fuzzy Hash: 01a3d1f3fba47da1ffe6a1efd47f70ed371d5d0c755dffbcd21c36b999de7be4
Instruction Fuzzy Hash: 1CD1C3B1A087419FD314CF19C4906ABBBE7BFD4314F18CA1EE89947355DB309986C792

Function 005FA620 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 5c7d39c72b9dc2a8793ed3851bb8d840dbda081839c7df34e62c964b9ad74f77
Instruction ID: c60b91fb3640fcaaf110e13f5c625437d4b112ab6ab95eaef1d3a620d70ee08b
Opcode Fuzzy Hash: 5c7d39c72b9dc2a8793ed3851bb8d840dbda081839c7df34e62c964b9ad74f77
Instruction Fuzzy Hash: DCD180B1E003189FCB14DFA4D9859BEBBB9FF58300F14452EE509AB241E778AD45CB92

Function 006806D0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ab3d252265da002bfccc26243b6e29d293ce2dc6890658c72da90fed2f6a4d
Instruction ID: db69df9bbbc3cecde21383570f5be0eddfd85dad3b8efbb8878aa15008823b77
Opcode Fuzzy Hash: b4ab3d252265da002bfccc26243b6e29d293ce2dc6890658c72da90fed2f6a4d
Instruction Fuzzy Hash: A5C193B5A002069FEF54EF68D8D1AAEB7B6BF84304F104A2DD506A7351E730BD49CB91

Function 007A11E1 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f955c51dd22556d9148dddf46c64a11879e3d78cb738c350b8b2033061cd4ea
Instruction ID: 59e32ae537266b4971345972229a24e1616b6e58ff505dd32c1c451249694a57
Opcode Fuzzy Hash: 2f955c51dd22556d9148dddf46c64a11879e3d78cb738c350b8b2033061cd4ea
Instruction Fuzzy Hash: 79C1D873A115414BF71C8B18C892B72B7D2AFD6360F5E876DC467CB3A2DA78D851C640

Function 0050D457 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60bddebb240f5cbe791d0f92cdf5bec08009a8e00653e4cdc73227f5089968d3
Instruction ID: 47845127c0a47c695642731ca5290a5cc7bd06bb62a8513a476b84c0fcdc34d6
Opcode Fuzzy Hash: 60bddebb240f5cbe791d0f92cdf5bec08009a8e00653e4cdc73227f5089968d3
Instruction Fuzzy Hash: FFC164A003AF6685C7D3FB34951014BF3E0BFDA28DF400A4AD548D6865EB7FE94E6225

Function 00505010 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd09723fc643d0e2ee6b257d94cca0fce2373df82c73f826f93028f387d61145
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: dd09723fc643d0e2ee6b257d94cca0fce2373df82c73f826f93028f387d61145
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 006555E0 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f7869a26dbdbb0e71799b8515c26479de9f344167db2ee2a6ef2e99e9ea76e
Instruction ID: 38b623fa060ffd79b917a63fea746be45ce15b1a526b6598b43eb940dbe73358
Opcode Fuzzy Hash: f1f7869a26dbdbb0e71799b8515c26479de9f344167db2ee2a6ef2e99e9ea76e
Instruction Fuzzy Hash: 82B12A71A04A61CBCF148F28C4A867AB7E3EF54321F25856DDCA79B391D734E9498780

Function 005CA470 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11178fee2d167c45d635a44e9ceee164eb9d27fe2fd6ddcdcd947bebbde2ced0
Instruction ID: e623049987e62c07ccc873d4fe4d07ae460286dc3176f30832da658739ed85f8
Opcode Fuzzy Hash: 11178fee2d167c45d635a44e9ceee164eb9d27fe2fd6ddcdcd947bebbde2ced0
Instruction Fuzzy Hash: CFC19171E006198FCB14CFA9C884BADBFF2BF88318F25826DD4559B251E7759C82CB91

Function 008070E8 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b5928cc5d3ec0500b5e05899a167e54f4e61bcd7ca40d2b72351ccbb0528db1
Instruction ID: 38870bec667cd9d07e3d6ba132dc0f5a0b9b2957b922f204a17fedee83987b68
Opcode Fuzzy Hash: 8b5928cc5d3ec0500b5e05899a167e54f4e61bcd7ca40d2b72351ccbb0528db1
Instruction Fuzzy Hash: 0AC17DB2E1441A8FDB55CE7CCC816ADB7B2FF99310B294278E911EB3C4D734A9418B90

Function 007A11F9 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b147456ba6f2019fe5bb3477bafdfe3a4a5ad35bcd7147e7b08d4a6e8ec615
Instruction ID: 83678e95e20f3072d3a7abe055ef17079d0175723262acbf1e2143ec905b9a16
Opcode Fuzzy Hash: c3b147456ba6f2019fe5bb3477bafdfe3a4a5ad35bcd7147e7b08d4a6e8ec615
Instruction Fuzzy Hash: 77B1D872B026414BF71C8B18C8A2B76B791AFD6320F5E876DC467CB3A2DA78D851C640

Function 00776010 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2880f7751f999d304a173a13fb9f861c01b2b6b0a8e458dc1448aee48823b75d
Instruction ID: 50a0747fec216e18abf411ff3bff9115c4fd0e146b6d28738894b85b33dcf3eb
Opcode Fuzzy Hash: 2880f7751f999d304a173a13fb9f861c01b2b6b0a8e458dc1448aee48823b75d
Instruction Fuzzy Hash: 5FA1A4B3A0191147DF1D8A08CCA27767712FB91760B1A826DCD679B78ADE75E812CB80

Function 0080EAF8 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6dbde2884ab789afb1f9499e376dfb743a9dffee4e02e0b6c432ad17d2c7bfb
Instruction ID: 3406c040b8a911b872ea8bc2007d0c859f1f3b90f860bbf0362770d15ecf495f
Opcode Fuzzy Hash: d6dbde2884ab789afb1f9499e376dfb743a9dffee4e02e0b6c432ad17d2c7bfb
Instruction Fuzzy Hash: 60C17071A00B469FD768CF68D890BAAB7F1FF48310F14862DE95A97792D734B841CB50

Function 00794C80 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d47a10f7097242939072315a749985efcd8c4063087575bae9a8ad30f761574
Instruction ID: e93fe0a9db1e3e6aa2849bcf5883915834927dcce01f907ffee3cd3406fc7167
Opcode Fuzzy Hash: 5d47a10f7097242939072315a749985efcd8c4063087575bae9a8ad30f761574
Instruction Fuzzy Hash: C381BFBBE1263187EB24450A9C417A26693BFD0764F2F4654CD6D7B349CA76EC03CAC0

Function 008072A8 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452b24530c77dc6189d8cb8dd84bbcfa94de61414f0b256a4d11fe41c8d2d848
Instruction ID: 47232cdb25a07de8fb8cf4556d30ec8ff7987e03f99e443ac964804472c29192
Opcode Fuzzy Hash: 452b24530c77dc6189d8cb8dd84bbcfa94de61414f0b256a4d11fe41c8d2d848
Instruction Fuzzy Hash: B0A1A1B2E145198FDB55CF68CC806ADBBB2FF99310B294278E915EB384D734AD11CB90

Function 0080551C Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab51504c3533a4cf24cf617c098cc9bcf4ab3b70ddd200292cc2e11a298381e
Instruction ID: dd9a8840c4bc61bfa6894dc202ac5b49ac28f17cd1d90cbb0e5fb63f47417bb0
Opcode Fuzzy Hash: aab51504c3533a4cf24cf617c098cc9bcf4ab3b70ddd200292cc2e11a298381e
Instruction Fuzzy Hash: 1AA130B2E109159FDB54CF68DC849AEB7B2FF98310B198239E815E7394D734A950CFA0

Function 006F53E1 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7a34d4c170fc7e7a27322bd566b9cadbeef666d6848ab92b4c760d87f14735
Instruction ID: aa403a941179f5dff2df513b43ee49b352354b4b077dd97aebb625fc63e75101
Opcode Fuzzy Hash: ff7a34d4c170fc7e7a27322bd566b9cadbeef666d6848ab92b4c760d87f14735
Instruction Fuzzy Hash: 81B15E31510A089FD715CF28C48ABA47BE2FF45365F658658EAAACF3A1C335DD92CB40

Function 0060B490 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31df99cf7879f0e49deaa822473946a77ea40a8b0987082f17e33ed844d36a2e
Instruction ID: 346eb7b26ad6a8eb39d9ffe5a74ace554158848e7696ad0def739a1ccf233e19
Opcode Fuzzy Hash: 31df99cf7879f0e49deaa822473946a77ea40a8b0987082f17e33ed844d36a2e
Instruction Fuzzy Hash: 3B910671E002058BCB14DF29D8556ABBBB7BFC4300F48816CE9069B386EB71ED46CB91

Function 007A1281 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ff3064143456a14cb185cdd88c8b370ff8e48859e03d724578e16ccbcf7a28
Instruction ID: 9f035741ee2eb3da0ecb7cfc1f2d1cda8412cdc23fc97144e6e250929c7a1040
Opcode Fuzzy Hash: 94ff3064143456a14cb185cdd88c8b370ff8e48859e03d724578e16ccbcf7a28
Instruction Fuzzy Hash: 4791E772B125414BFB1C8B18C892B72B791AFD6370F5E876DC467CB3A2DA78D851C640

Function 00756870 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec9bac0a76cd2ea6ed15bf165c61f03a2e8a1f6adcbbe65c62da893c8d2a548
Instruction ID: 99a727d7071806101c81239e22d7800771f2ffdfe15e29851e045537b752e0b8
Opcode Fuzzy Hash: dec9bac0a76cd2ea6ed15bf165c61f03a2e8a1f6adcbbe65c62da893c8d2a548
Instruction Fuzzy Hash: 1AC1A865C2DFD985E3229B3E940337BE3A0BFFB254F50EB1ABDD431811EB614245A245

Function 0074E540 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa8c413d52d2902d4443c778d8e7a5b3e30fd74c251c3c5c272037d31e9fb57b
Instruction ID: e6c62da002a677be91c1a8ae816feb67198ca8ad423b7ec198bd7fe16a5dd36b
Opcode Fuzzy Hash: aa8c413d52d2902d4443c778d8e7a5b3e30fd74c251c3c5c272037d31e9fb57b
Instruction Fuzzy Hash: A691D4B2D103469BEB109F20DC41FFAB76CFF99304F104669E84996102FB79DA95CBA1

Function 007A12A6 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1eefcc3b565151b850eb428617c64ee4ba7825f33d703d77a448c27a83f9dcc
Instruction ID: 17810c898d0b89af370b896955d88c93e1c706ddbb807a73ef9cecac2f2e7e3f
Opcode Fuzzy Hash: b1eefcc3b565151b850eb428617c64ee4ba7825f33d703d77a448c27a83f9dcc
Instruction Fuzzy Hash: A581E773A125414BF71C8A18C892BB6B7D1AFD6370F5E836DC467CB3A2DA78D851C640

Function 00787050 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf35c3ea9dd340c5bbeff3813e14a9d995df27ff6c3093d26e543dfe291c30d
Instruction ID: 066c6683953ec851f7451811a55124f75df9a5d93c721c744aca3c67ef4d6217
Opcode Fuzzy Hash: caf35c3ea9dd340c5bbeff3813e14a9d995df27ff6c3093d26e543dfe291c30d
Instruction Fuzzy Hash: FC81C4B6B552058BCB18DBA8CC90ABA77A6BFC435472A4039D816DB312EE75DD01CB90

Function 007A12D3 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de2efbe54a3bea9e4de5de9fb1484516236f29dd6eaab171c0db81374b0372c
Instruction ID: 845d88abe591a09f5159d80dd00d632d91e1e9fc127c1ba2c618407ca85cfbc3
Opcode Fuzzy Hash: 1de2efbe54a3bea9e4de5de9fb1484516236f29dd6eaab171c0db81374b0372c
Instruction Fuzzy Hash: 3C81D872B025414BF71C8A18C8A2BB6B7D1AFD6370F5E836DC467CB3A2DA78D851C640

Function 0060A0B0 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bedfcee642fbbe04e487902260e9ab45d94317119caeaac2d0c50d7fa658346
Instruction ID: f064f9a4e8e11034c79d6d1d92b42f5afc4287d260a189bf524079a0bb696166
Opcode Fuzzy Hash: 6bedfcee642fbbe04e487902260e9ab45d94317119caeaac2d0c50d7fa658346
Instruction Fuzzy Hash: BC81E3709407418BC728CF75C8907ABB7E6BF95344F148A2DD48A8B381E771F999CB92

Function 005C4050 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30be4ad688c150f0ab5eb73220d3b89ad43a32c873ff48db5d316b8056fb751
Instruction ID: 9c207d1c903ca8323325b57a0823141018909f0eff87e615fe0d7e1fb757cd58
Opcode Fuzzy Hash: a30be4ad688c150f0ab5eb73220d3b89ad43a32c873ff48db5d316b8056fb751
Instruction Fuzzy Hash: 5271C735B002168FEB24CE98C856FBE77A1FB84710F59852DE946AB2C4D374AD90CF94

Function 00788980 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acdc276538c52b37b8dbd05918dbb088fe80b4622f1abff5e6a33880ee1aa8cd
Instruction ID: f601eacd0ce1df81d23d5981efd6c082a6da703bfbf9628e9d915351b4e3b496
Opcode Fuzzy Hash: acdc276538c52b37b8dbd05918dbb088fe80b4622f1abff5e6a33880ee1aa8cd
Instruction Fuzzy Hash: 9F61E4B36615444BC3599628CC50B727BE9EF923A432D827ED063CF2A2FE26E513C741

Function 00785270 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30ca3f2afa91fec25fc1875449193dc65832880763bfe9944d812ecec69ef1a
Instruction ID: 89870791fb1bff883edd96bde00dd646052c69ee44378107874d914d35cde006
Opcode Fuzzy Hash: a30ca3f2afa91fec25fc1875449193dc65832880763bfe9944d812ecec69ef1a
Instruction Fuzzy Hash: D961F4B3A4197147C71D8A08CCA1336B756AF80725B1E826CCD6BEB785CA65ED12CBC0

Function 007986B0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 245ff1835752e5879b86d1161ed74042edc1c82240d790596ddce2fa1a6d5bc0
Instruction ID: 50210fa48a3a227228b3289e5f5a5e269be5efbf4a70a67f1eeecce8ba61099c
Opcode Fuzzy Hash: 245ff1835752e5879b86d1161ed74042edc1c82240d790596ddce2fa1a6d5bc0
Instruction Fuzzy Hash: 946102B3B216144BCB58CAA8DC90BB677E6EF8135472E413DC416CB352EE76E912CB50

Function 006992B0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 905037eb153c527972886b8d23a849b4304f382538d774f5e74425ed17bd5b31
Instruction ID: 4247d720468497b9fe0aa2e7223eac3fb7761a7196cdf08745da37e3d8e6780a
Opcode Fuzzy Hash: 905037eb153c527972886b8d23a849b4304f382538d774f5e74425ed17bd5b31
Instruction Fuzzy Hash: 2C71C230E042598BDF26CEACC4803EDBBEBAB85704F28812DD8559BB81D7709C87C760

Function 005ACE00 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1cfa7613c222e3bc4f2d9b30b9ceb9271aaf7ed1b35ae0fbbea020cb96e306
Instruction ID: 3928c5905db5135eceb69fd6c71493efc40b0aad7f29e3ada766c21efc57e9d5
Opcode Fuzzy Hash: bd1cfa7613c222e3bc4f2d9b30b9ceb9271aaf7ed1b35ae0fbbea020cb96e306
Instruction Fuzzy Hash: AE5105B2A003119FEB009F24CC8A76ABF93FBD6350F158528FD959B282E774DD458792

Function 0076E9D0 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 380f0582f1a7a3d35ecf50dff09cc3dddd76d1b713577b6457e66bc07047133e
Instruction ID: 03146184ee28fb240d881be4f9efd91a8ab3d72e44a8d11191bd25ceabe7e7f5
Opcode Fuzzy Hash: 380f0582f1a7a3d35ecf50dff09cc3dddd76d1b713577b6457e66bc07047133e
Instruction Fuzzy Hash: E9517EB7E1697147CB2546488C01362BB51AF51B30B2F8754CDAEBB391C725FE22CAD4

Function 0076B080 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8fb473da4d2a0015d056b3fd43d449f346cc77f542f36ca4d76e88ffe771a60
Instruction ID: 3e44cb8ea7926c325ea6086aeedcc3fdcbb79933590614b09ea170ad43dde61a
Opcode Fuzzy Hash: b8fb473da4d2a0015d056b3fd43d449f346cc77f542f36ca4d76e88ffe771a60
Instruction Fuzzy Hash: DA51D1B37116484BD7298628CCA1B7277E5FF92354B19423DD863CB292EF26E953CA40

Function 0059D0B0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b437e87ff809081c626b25cccf68e846ec53e5ffbffa22872ec4f380117eb96
Instruction ID: 9575e0a7aebcfc21f42382e1f79b82efde44771737fe11334255d0e2e4298448
Opcode Fuzzy Hash: 3b437e87ff809081c626b25cccf68e846ec53e5ffbffa22872ec4f380117eb96
Instruction Fuzzy Hash: 7561B476E001198FDF04CF69C8807AEFBF2BF94380F15856AD855AB251D735AC41DBA0

Function 005AC6F0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05909d623de30bdb1b76c71016768ce52044e2b1c2f323f1bbb97bdeb066defa
Instruction ID: 905c27b60c2050062bd28a8e045918d2fa59a2483b38faa9b5a6955e81cf0459
Opcode Fuzzy Hash: 05909d623de30bdb1b76c71016768ce52044e2b1c2f323f1bbb97bdeb066defa
Instruction Fuzzy Hash: FD51B0726003019FDB14DF24C895A2FBBE6FFCA320F048A2DF49697251EB74E8458795

Function 00667410 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f20a03df41510bcfb50170672aee766a40c79add5b526a82a31ef4102bd846
Instruction ID: 34b88883e155cbb64d3d8229c1f134a0a051b8d363368218fbc5a9472f87e5ab
Opcode Fuzzy Hash: c5f20a03df41510bcfb50170672aee766a40c79add5b526a82a31ef4102bd846
Instruction Fuzzy Hash: B8519872E042254BDF18CE6DD8546BEBBF3EF85314F1582ADD866A7390DB349D018BA0

Function 005032A2 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d08c3691fcdf1036dd1eac21b1a610b14359f24747db25621eb33212835e938e
Instruction ID: 0f0d1d2c3569faebd5070fc88af70d2818825d07d9b92b5409519aaa235d5bdf
Opcode Fuzzy Hash: d08c3691fcdf1036dd1eac21b1a610b14359f24747db25621eb33212835e938e
Instruction Fuzzy Hash: 58519F64C1AF9647EB076B3A8443761D700BFE3264A10DB5BECF13DDA5E711BAC4A240

Function 005C2DC0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 172aff792a9242c073491d1bfe9b94e22fbcc89cd3223beb78608376b3bf1142
Instruction ID: 95ff97f6ac88922bcd13629a2b6f02065a1ff81cc644476e8f9f71a6f8d05332
Opcode Fuzzy Hash: 172aff792a9242c073491d1bfe9b94e22fbcc89cd3223beb78608376b3bf1142
Instruction Fuzzy Hash: 57514A21908BC646E372C77CC809BABFF946F46334F088B9DD5E9590D3DBA46259C386

Function 00616D80 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f183eba7d6edd0ed9db95eeb4ceef5146e85f6460ad937f9a82dfcf0b708639
Instruction ID: 6890b8d8ddf03e194c68ef8d672504f5c981050d83660f3bb9e2a1cf31951d8f
Opcode Fuzzy Hash: 5f183eba7d6edd0ed9db95eeb4ceef5146e85f6460ad937f9a82dfcf0b708639
Instruction Fuzzy Hash: 12519F78A002058FCB24DF18D895AAABBF6BF84300B04856DE9069B346DB30FC55CF91

Function 00756610 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54efb2fea1b67d3b834ef1850852e89aa1cc77697ec85c36bed5e6f606c29d39
Instruction ID: b8f205a9bd7f58abcda17cdaae9a27f0aa087edabb49180666ea26750b8da6c7
Opcode Fuzzy Hash: 54efb2fea1b67d3b834ef1850852e89aa1cc77697ec85c36bed5e6f606c29d39
Instruction Fuzzy Hash: 4A51FC75D39FCA46E3136B3DA403226E714AEF7598E20E71BFDE438C55FB5192826108

Function 00773290 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a43a10b1203b184a1c5c0d3ca51d7fab509cef2394fe5c67ce62e608bf7b34
Instruction ID: 438a84720e25521543adfbbe4cd2196e224739aee577ae72833b8616511b78d8
Opcode Fuzzy Hash: d2a43a10b1203b184a1c5c0d3ca51d7fab509cef2394fe5c67ce62e608bf7b34
Instruction Fuzzy Hash: 174174B3E016304BEB244685C881362BB52AF85764F1F82A4CD5CBB355CA66ED13DBC0

Function 0078C7C1 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8bdb487b1f9789eb0b02bc5bcc392b441ead38d158e25b271bd9a2d0c02f6e3
Instruction ID: 3407781ef43036ca72687f15397372d540f430875379a4ee28269bf6dec43c0b
Opcode Fuzzy Hash: a8bdb487b1f9789eb0b02bc5bcc392b441ead38d158e25b271bd9a2d0c02f6e3
Instruction Fuzzy Hash: 9C417871B88BC55BC71BDA3CC44471EA6D28B95318F28863DE99ACB7C2D5799805C3A0

Function 0078C7C9 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8a6ec8614ba785132a3c8b615571a50821e41f66866c60bcce4664b19a893e
Instruction ID: bbc4c7989a7245b065dd29c8fc9eccd3705f18cb8a7b76f90e1e4504664bc234
Opcode Fuzzy Hash: 4b8a6ec8614ba785132a3c8b615571a50821e41f66866c60bcce4664b19a893e
Instruction Fuzzy Hash: 5541AB71B886C55BC71ADA3CC44471EABD29B95314F28823CE99ACB7C2D539E801C3A0

Function 00793500 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d0d61d728cd2f284f3142088949ad29912d8dab6e1d1a98c1119e6f1e938fd
Instruction ID: 7e40f7945e8f537409a395bb9ffd5905373822859485e28134eb29de75406aa0
Opcode Fuzzy Hash: e1d0d61d728cd2f284f3142088949ad29912d8dab6e1d1a98c1119e6f1e938fd
Instruction Fuzzy Hash: AA3181B2B1190107DB6C851ADCA13B762D3EBE4311F1DC23CD95BC6BC9DA39D9128740

Function 0056A2A0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b659a2fd3ac232a2263cde335208bad80a7cf2a41dfe4f5069f901364e1b97f
Instruction ID: 02ec4eebbc29bf448e6682332d79699f4cced9ea48e547b7f40f3603b727c498
Opcode Fuzzy Hash: 5b659a2fd3ac232a2263cde335208bad80a7cf2a41dfe4f5069f901364e1b97f
Instruction Fuzzy Hash: 31318037E041158FE714CE67CC8466BBBA3BFD9314B27C565C9187B314EAB1AD038AA1

Function 00642FE0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6c377853b3a9bbebdd9f6c872a439350378d3081db180646ec9b85ca1c24fa
Instruction ID: adce771afcc65702983769d4e1602674ee9d7423fdf1a2ccf171946c3db922d8
Opcode Fuzzy Hash: fa6c377853b3a9bbebdd9f6c872a439350378d3081db180646ec9b85ca1c24fa
Instruction Fuzzy Hash: 5241B4EAC29F8C06EA13173D94831A2B310AEB3DA8B21DB47FCF475761FB11A1556314

Function 00801154 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2fac2717f7390d7c745e7f61d5596896c3d8020fb3fcc776386e56021d4cb7
Instruction ID: ed847769079c650d53eb308f0e93477226b9234d6874985a1f1f7e9dd4171392
Opcode Fuzzy Hash: 5f2fac2717f7390d7c745e7f61d5596896c3d8020fb3fcc776386e56021d4cb7
Instruction Fuzzy Hash: 2F213DB6B609190BDB5C99BCFC656BE3382FBD4312744463CE757CB7C2E934A4158241

Function 0080115C Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f1871a5ee7520cf434757fbac2816290b8a1a1f4e7f6b265d9fb11b510438cb
Instruction ID: b51264d656e508d4010e4788ecad3e0ab938035823751ce582145c2a9a9bedd2
Opcode Fuzzy Hash: 7f1871a5ee7520cf434757fbac2816290b8a1a1f4e7f6b265d9fb11b510438cb
Instruction Fuzzy Hash: 662178B2B206190FDB4CC9ACECA41BD77A2EBD4242388417DE657CF783D934A816C300

Function 00801158 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d985661821c18ceb5109660890097689c14563e2ff283e9cb5ac1534968d14db
Instruction ID: d7dc9d56977abdc8a466439fbeb7ca8a958acdbd1118beb3dfbdb07d00e82c43
Opcode Fuzzy Hash: d985661821c18ceb5109660890097689c14563e2ff283e9cb5ac1534968d14db
Instruction Fuzzy Hash: E2216872B206190FDB4CC9ACECA41BD73A2EBD4242388416DE657CF783D934A815C300

Function 00501000 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b31c6e1e5518d89014befebaf7ed6d128ec61848a8d1619b4280668b8b5592
Instruction ID: c5f2aa7dc84a60560e8ea04d913d46bebd445d3fb276356b826bb592a1c1d49c
Opcode Fuzzy Hash: 42b31c6e1e5518d89014befebaf7ed6d128ec61848a8d1619b4280668b8b5592
Instruction Fuzzy Hash: 0131DFB4A006048BEB44CF19C4D0B82BBE2BF98350F18C2B9DC4C8F35ED77599558BA2

Function 005043C0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9cbc7f7bfdf23066968fc2e56befe3aae15ecbac89b9c4387f9be3f21397580
Instruction ID: 533a6788b7ce8db4c4e85c58aa6e8e4bad913785b7a8ed8504d6efc4656b6ce6
Opcode Fuzzy Hash: e9cbc7f7bfdf23066968fc2e56befe3aae15ecbac89b9c4387f9be3f21397580
Instruction Fuzzy Hash: 45D06C705147019FC646DF20D19086AF7B1FF8A211F02EA88D449ABA68D774EAC8CB55

Function 006E533A Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 305COMMON

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 006E53A5
DName::operator+.LIBCMT ref: 006E54E8

Part of subcall function 006E42FF: shared_ptr.LIBCMT ref: 006E431B

DName::operator+.LIBCMT ref: 006E5493
DName::operator+.LIBCMT ref: 006E5534
DName::operator+.LIBCMT ref: 006E5543
DName::operator+.LIBCMT ref: 006E566F
DName::operator=.LIBVCRUNTIME ref: 006E56AF
DName::DName.LIBVCRUNTIME ref: 006E56B9
DName::operator+.LIBCMT ref: 006E56D6
DName::operator+.LIBCMT ref: 006E56E2

Part of subcall function 006E485B: Replicator::operator[].LIBCMT ref: 006E4898

Strings

EWn, xrefs: 006E54C8, 006E5485
EWn, xrefs: 006E5345, 006E539E, 006E53B9, 006E5539, 006E557B, 006E560E, 006E566B, 006E56DB

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]shared_ptr
String ID: EWn$EWn
API String ID: 1043660730-3123151949
Opcode ID: 4f781077eecc89893ef314bc5cedabbf135db2fa0349fb161d23d4a11b8918ba
Instruction ID: 7548a6607f87bcc7905be419d82b3d5e2344ed05535aa76cdb536f06850f864e
Opcode Fuzzy Hash: 4f781077eecc89893ef314bc5cedabbf135db2fa0349fb161d23d4a11b8918ba
Instruction Fuzzy Hash: A4C1ECB1902784EFCB64DFA5C844BEABBFAFB08304F10445DF146A7291EB749A84CB14

Function 006E9327 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 332COMMON

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 006E93F0
DName::operator+.LIBCMT ref: 006E942D
DName::DName.LIBVCRUNTIME ref: 006E9441
DName::operator+.LIBCMT ref: 006E9450
DName::operator+.LIBCMT ref: 006E94DE
DName::DName.LIBVCRUNTIME ref: 006E9506
DName::operator+.LIBCMT ref: 006E9514
DName::operator+.LIBCMT ref: 006E954E
DName::operator+.LIBCMT ref: 006E958F
UnDecorator::getReturnType.LIBCMT ref: 006E95BF
operator+.LIBVCRUNTIME ref: 006E96C1

Strings

Y}n, xrefs: 006E94F7, 006E9605

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID: Y}n
API String ID: 2932655852-2897709001
Opcode ID: 58e78b4011d7c95d5fcdf49e40165b607093b91417fb802e82f8ffea16506fc8
Instruction ID: 3730e1d61a5bfde627e4232d28aecc0e4bd4b634198ce91063bba64afdd37809
Opcode Fuzzy Hash: 58e78b4011d7c95d5fcdf49e40165b607093b91417fb802e82f8ffea16506fc8
Instruction Fuzzy Hash: F7C152B5902388AFDB54EFA6D8959ED77B6EF18300F14006EF502A7391EF309A45CB64

Function 006E485B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 185COMMON

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 006E4898

Strings

SHn, xrefs: 006E4A5D
]Fn, xrefs: 006E48EA
]Fn, xrefs: 006E49A8
@, xrefs: 006E4A04

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: Replicator::operator[]
String ID: @$SHn$]Fn$]Fn
API String ID: 3676697650-3598611513
Opcode ID: 6734650a3f7a270d075f7b14bee4a5f2182ebad318848425d0471916efe08f43
Instruction ID: 658c9d0f685f87b7097efdaeae8ca7b5c469d2243e4a70466b4aa636bc5d9c9d
Opcode Fuzzy Hash: 6734650a3f7a270d075f7b14bee4a5f2182ebad318848425d0471916efe08f43
Instruction Fuzzy Hash: C961B271D01389AFCB50DFAAD845AFEB7BAFF08310F104029E611A7291DB749A45CB98

Function 0052C7E0 Relevance: 11.6, Strings: 9, Instructions: 327COMMON

Download Yara Rule

Strings

e, xrefs: 0052D3D0
yPac, xrefs: 0052D460
inst, xrefs: 0052CEB1
Prox, xrefs: 0052D3C9
anne, xrefs: 0052D05D
licy, xrefs: 0052C818
yMod, xrefs: 0052D3C2
efix, xrefs: 0052D1B7
cUrl, xrefs: 0052D459

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: Prox$anne$cUrl$e$efix$inst$licy$yMod$yPac
API String ID: 0-4143399809
Opcode ID: 01b1804e77eecf419198e49eab6469db9f5a914022fb36b5d5f4ce098743bcff
Instruction ID: c850246bc65cd7eba450809f659c53a35f81b9ca6377db08110a653f89716693
Opcode Fuzzy Hash: 01b1804e77eecf419198e49eab6469db9f5a914022fb36b5d5f4ce098743bcff
Instruction Fuzzy Hash: 1AB115B1D402498FDB04CF68D845BEEBFB5EF55304F14C02AD449AB252E774AAC4CBA6

Function 006E4A74 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 006E4AE3
shared_ptr.LIBCMT ref: 006E4C53
DName::operator+.LIBCMT ref: 006E4C7F
shared_ptr.LIBCMT ref: 006E5171

Strings

EWn, xrefs: 006E4A7B
rUn, xrefs: 006E4C84

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: shared_ptr$NameName::Name::operator+
String ID: EWn$rUn
API String ID: 3044678202-2838828506
Opcode ID: c0ac6f100a55ae5f27cb8df144b4c0794b8a5a9c76a3e835538fe3f02b01b99d
Instruction ID: 3dc52539d304e251e0a6a369ffe5e0ade8dde053ac588c091b4a4dabc218ae8e
Opcode Fuzzy Hash: c0ac6f100a55ae5f27cb8df144b4c0794b8a5a9c76a3e835538fe3f02b01b99d
Instruction Fuzzy Hash: 6281C2719023999FCB11DF7AC888AFDBBBABB08700F244519E511AB351DF70DA41CB50

Function 006E62D2 Relevance: 10.7, APIs: 7, Instructions: 190COMMON

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 006E63A8
UnDecorator::getSignedDimension.LIBCMT ref: 006E63B3

Part of subcall function 006E5C9E: DName::DName.LIBVCRUNTIME ref: 006E5CFC

UnDecorator::getSignedDimension.LIBCMT ref: 006E649F
UnDecorator::getSignedDimension.LIBCMT ref: 006E64BC
UnDecorator::getSignedDimension.LIBCMT ref: 006E64D9
DName::operator+.LIBCMT ref: 006E64EE
DName::DName.LIBVCRUNTIME ref: 006E6654

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: Decorator::getDimensionSigned$NameName::Name::operator+
String ID:
API String ID: 1735248365-0
Opcode ID: 30151563c41bfed9261d010705fc71310d179d853545a9b21f6cc975b54dac20
Instruction ID: 3af3ea247b72316e8adef9b693064a3764e825ce213c54a7872c1fbe47f977ed
Opcode Fuzzy Hash: 30151563c41bfed9261d010705fc71310d179d853545a9b21f6cc975b54dac20
Instruction Fuzzy Hash: 8351F772C033C599CB48EFBBDD8E9FE776BAB20380F10551EF102A62C2DD65DA068655

Function 006E918A Relevance: 10.7, APIs: 7, Instructions: 151COMMON

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 006E9218
DName::operator+.LIBCMT ref: 006E926B

Part of subcall function 006E42FF: shared_ptr.LIBCMT ref: 006E431B

Part of subcall function 006E4482: DName::operator+.LIBCMT ref: 006E44A3

DName::operator+.LIBCMT ref: 006E925C
DName::operator+.LIBCMT ref: 006E92BC
DName::operator+.LIBCMT ref: 006E92C9
DName::operator+.LIBCMT ref: 006E9310
DName::operator+.LIBCMT ref: 006E931D

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: Name::operator+$shared_ptr
String ID:
API String ID: 1037112749-0
Opcode ID: f82d5842827c2b6de8845d74ffd2378d5067b003bad6eebde85e4cf8ac68ca5f
Instruction ID: 16df3afc89224784613754bdf70b8f451df516595d70a4265833009e381ce54f
Opcode Fuzzy Hash: f82d5842827c2b6de8845d74ffd2378d5067b003bad6eebde85e4cf8ac68ca5f
Instruction Fuzzy Hash: 88518EB1D05348AECF15DBA5D845EEEBBBAEF08300F04415AF605A7281EF749B44CBA4

Function 005E8650 Relevance: 10.1, Strings: 8, Instructions: 118COMMON

Download Yara Rule

Strings

comm, xrefs: 005E876A, 005E876E
va_s, xrefs: 005E8702, 005E8706
w64, xrefs: 005E86BF
size, xrefs: 005E8796, 005E879A
c, xrefs: 005E8721
allo, xrefs: 005E8731, 005E8735
iswo, xrefs: 005E86CF, 005E86D3
it, xrefs: 005E875A

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: allo$c$comm$iswo$it$size$va_s$w64
API String ID: 0-147982029
Opcode ID: ce06b41d286db489200ce203959556e4f7c52fdfe24cd834b82df2d7cb886408
Instruction ID: af8e83334c64740fca202fad3920e6d6d20a8587e46193b4585c4f90e84c2147
Opcode Fuzzy Hash: ce06b41d286db489200ce203959556e4f7c52fdfe24cd834b82df2d7cb886408
Instruction Fuzzy Hash: AA41B2B15083419FD714DF65D888BABBBE9FFC4304F14492EF48A8B241DBB6D9448B92

Function 006DCD39 Relevance: 9.2, Strings: 7, Instructions: 456COMMON

Download Yara Rule

Strings

p, xrefs: 006DCE91
p, xrefs: 006DCE2F
:, xrefs: 006DCDFD
f, xrefs: 006DCE8A
f, xrefs: 006DCE28
f, xrefs: 006DCE44
p, xrefs: 006DCE4B

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: :$f$f$f$p$p$p
API String ID: 0-1434680307
Opcode ID: 899d734d825b5fb5a5e58ee12f39e47d624c45232a828c3c823dfe8bdbf64f55
Instruction ID: bc5653ceaa26fd2ae253cf3397499db75a3ad521b661cbade0e91c55f31a75b2
Opcode Fuzzy Hash: 899d734d825b5fb5a5e58ee12f39e47d624c45232a828c3c823dfe8bdbf64f55
Instruction Fuzzy Hash: C7F19FB9D00209AADF24AFA4D5486EDB773FF81B14FA4815BE4127B384D7308E89CB55

Function 006E8806 Relevance: 9.2, APIs: 6, Instructions: 201COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 006E88C1
DName::operator+.LIBCMT ref: 006E8CA7
operator+.LIBVCRUNTIME ref: 006E8CED

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: Name::operator+operator+shared_ptr
String ID:
API String ID: 534093714-0
Opcode ID: c7ab59d2f411e911183cee759a48b1aa544cb8cfcf27dbd1adc1e9208db018b8
Instruction ID: a8a8b558413d0d3f69691b9f8c5c5cb680267fc49c965935cf0b7dc5a0af88b8
Opcode Fuzzy Hash: c7ab59d2f411e911183cee759a48b1aa544cb8cfcf27dbd1adc1e9208db018b8
Instruction Fuzzy Hash: 1871A0B1C02389DFCB14DFAAC5885FEBBB6AB06700F248069D50AA7355DB349745CF91

Function 006F2BEC Relevance: 7.7, APIs: 5, Instructions: 248COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 006F2E27
__freea.LIBCMT ref: 006F2E2D
__freea.LIBCMT ref: 006F2E63
__freea.LIBCMT ref: 006F2E69
__freea.LIBCMT ref: 006F2E79

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: __freea
String ID:
API String ID: 240046367-0
Opcode ID: 7537ab034d506959f4f7427ac5dfd9a07d7a8cfef79d9c8fb61509abd32ee1f7
Instruction ID: e6fa06626b412198d848973f9b2ce2448d8e926351bdd1701d7af20c79cdf8be
Opcode Fuzzy Hash: 7537ab034d506959f4f7427ac5dfd9a07d7a8cfef79d9c8fb61509abd32ee1f7
Instruction Fuzzy Hash: 1271D27290424F5BDF209FA48C62BFF7BB7AF49310F280059EA14A7391D6359C418FA4

Function 00572120 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 459COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00572200

Strings

W, xrefs: 00572425
User, xrefs: 005721FC, 005721FF, 00572209
User, xrefs: 005722AE, 00572309, 00572333

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID: User$User$W
API String ID: 4218353326-20458557
Opcode ID: 4e439f342a8d9a1fca8e974eff8da22b32d3b266e66302255c473e4a5fc4a515
Instruction ID: b5f0e6deaada7df2339c895dcf817b0129aaa554ea2908789da7ceac764fc5be
Opcode Fuzzy Hash: 4e439f342a8d9a1fca8e974eff8da22b32d3b266e66302255c473e4a5fc4a515
Instruction Fuzzy Hash: 4602A271D003159BDF24DF20EC85BADBBB6BF44304F1485ADE90D67282DB74AA88DB91

Function 005395D0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0053989E

Strings

j7Q, xrefs: 0053964C, 005396FA, 00539729
em, xrefs: 00539848
User, xrefs: 00539896, 0053989D, 005398A7

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID: User$em$j7Q
API String ID: 4218353326-1669540676
Opcode ID: 1672eae076863600c7e852888a0d2e876b5b99ddaf2d055fec7fbb46a41de238
Instruction ID: c823f2936329328a832b2efc2d109201251972f44b0fb6f77df8dab1d3401d83
Opcode Fuzzy Hash: 1672eae076863600c7e852888a0d2e876b5b99ddaf2d055fec7fbb46a41de238
Instruction Fuzzy Hash: 22D118B1A44341ABD7609B10CC4AF5BBBE5BFC5750F04892DF84D57282EBB4A948C7A3

Function 005BA4E0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 354COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 005BA513
_strlen.LIBCMT ref: 005BA701

Strings

:, xrefs: 005BA8AD

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID: :
API String ID: 4218353326-336475711
Opcode ID: 69acf3597482d3e4b2e665ad3f51308161ad7492204812a0c88ef4cd7378061b
Instruction ID: ac6c80a6b9c433fc3ac878198e17f82bb2c5ec86bb74d6d86518743e97555525
Opcode Fuzzy Hash: 69acf3597482d3e4b2e665ad3f51308161ad7492204812a0c88ef4cd7378061b
Instruction Fuzzy Hash: FBC1F7B5E00214AFDB54EB60D885AFE7BB9FF59304F14401DF80567382EB75A942CBA1

Function 006593E0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0065942A
__aulldiv.LIBCMT ref: 00659440

Strings

, xrefs: 0065952B
-, xrefs: 006594BF

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: $-
API String ID: 3839614884-1933255201
Opcode ID: 1fb3baf07332ba46f2fa5f41b29e3957500d7583b6cf22b53cc3c2736f5f49ff
Instruction ID: c310911db2ccb29f009099d07f76a65ba22cc46c8efaca19cdd02ab40f7cde98
Opcode Fuzzy Hash: 1fb3baf07332ba46f2fa5f41b29e3957500d7583b6cf22b53cc3c2736f5f49ff
Instruction Fuzzy Hash: 25714771D003449FDB54DF38D880AAE7BA6FF85304F24812DED199B342EB315949C7A5

Function 005A4B80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 005A4BBA

Strings

L$S, xrefs: 005A4B84
`mC, xrefs: 005A4B83
PSJ, xrefs: 005A4B9B

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID: L$S$PSJ$`mC
API String ID: 4218353326-604876286
Opcode ID: 950e7dedee11c7a4fefee9e1f9f4858de8f1a3679e37bb5eb383bb567ee679d1
Instruction ID: 8c4050e59f098d517e0b54868f93df96025efe7dbbda19e4a31708dd73811aaa
Opcode Fuzzy Hash: 950e7dedee11c7a4fefee9e1f9f4858de8f1a3679e37bb5eb383bb567ee679d1
Instruction Fuzzy Hash: 5D314C716011158BCB18EEAC889873EBFA5FBC6720F14C63DD86A8B680E774DC058B91

Function 006E45BF Relevance: 6.2, APIs: 4, Instructions: 192COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006E45C6
UnDecorator::getSymbolName.LIBCMT ref: 006E4658
DName::operator+.LIBCMT ref: 006E475C
DName::DName.LIBVCRUNTIME ref: 006E47FF

Part of subcall function 006E42FF: shared_ptr.LIBCMT ref: 006E431B

Part of subcall function 006E67AB: DName::DName.LIBVCRUNTIME ref: 006E67F9

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: Name$Name::$Decorator::getH_prolog3Name::operator+Symbolshared_ptr
String ID:
API String ID: 1134295639-0
Opcode ID: 8483bf01f10d0d230f8b2dfbbd6efb223d6abee75c670b9c3e162c0c5cf69900
Instruction ID: 0a164539b570919e0e5accbd4ec5028a598f48f3c9912b6902d25ccec52a10e8
Opcode Fuzzy Hash: 8483bf01f10d0d230f8b2dfbbd6efb223d6abee75c670b9c3e162c0c5cf69900
Instruction Fuzzy Hash: 55717C75C063899FDF40DFA6D884AEDBBB6FB09310F24005AE901AB351DB349945CBA4

Function 006E85D4 Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 006E8709

Part of subcall function 006E4061: __aulldvrm.LIBCMT ref: 006E4092

DName::operator+.LIBCMT ref: 006E866A
DName::operator=.LIBVCRUNTIME ref: 006E874E
DName::DName.LIBVCRUNTIME ref: 006E8780

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=__aulldvrm
String ID:
API String ID: 2973644308-0
Opcode ID: 5988e614f3a184064b37aa7f1604eb42268290599c1255b36e5b133b69ab0163
Instruction ID: 29e9d31e35e934a481c0b74651da1013138fde19d6da2d0c771e22536de2849d
Opcode Fuzzy Hash: 5988e614f3a184064b37aa7f1604eb42268290599c1255b36e5b133b69ab0163
Instruction Fuzzy Hash: 61616DB4902395EFCF04DF95D881AEEBBB6FF45700F24815AE9156B391CB709A81CB90

Function 006E33E5 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 006E34AC
___AdjustPointer.LIBCMT ref: 006E34CF
___AdjustPointer.LIBCMT ref: 006E356B

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 433d856eb07633688b2acf41996a7b7150ac3556e4987b61868630e458d11fd8
Instruction ID: dff4cc44b223a5d5fb62107361fd1d818d3cae29aa46b5944fe6ccd8cbc349c3
Opcode Fuzzy Hash: 433d856eb07633688b2acf41996a7b7150ac3556e4987b61868630e458d11fd8
Instruction Fuzzy Hash: 3751F3726067A1EFDB298F52D849BBA7BE6EF04314F24442DE84247391E731EE41CB94

Function 006E8D62 Relevance: 6.1, APIs: 4, Instructions: 131COMMON

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 006E8D95

Part of subcall function 006E4288: DName::operator+=.LIBCMT ref: 006E429E

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: Name::operator+Name::operator+=
String ID:
API String ID: 382699925-0
Opcode ID: f2505ad04a8d885fd2b899eacfdf126a7211c734f293affe1efce2896d2cd4cb
Instruction ID: dcf7b0565373a24b15788fe96439cd430bbb1a74b202b76c6bec187419484eb3
Opcode Fuzzy Hash: f2505ad04a8d885fd2b899eacfdf126a7211c734f293affe1efce2896d2cd4cb
Instruction Fuzzy Hash: AF414C71D0238AEFCB04DFAAC8895EEBBB6EF54304F100019E505B7391DB749A49DB91

Function 006E2E47 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006E2E63
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006E2E7C

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: a80e27825ff6e75df18f77152f51063e6c550f732bbc5e21ae451ad967dd4478
Instruction ID: 851de6d18d025e9980bac45d8b0cf8b77dabc89b83fa0e99361371731a7ae5ca
Opcode Fuzzy Hash: a80e27825ff6e75df18f77152f51063e6c550f732bbc5e21ae451ad967dd4478
Instruction Fuzzy Hash: 5201FC3220BB639ED7A427B5AC968A72F4BFB05B74720032EF550951E0EF514C42515C

Function 005127F0 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 436COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00512811

Strings

-A, xrefs: 00512C18
@KL, xrefs: 0051288E

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID: -A$@KL
API String ID: 4218353326-3210587951
Opcode ID: 50053cfbcc9b68c6da5f6124d336af52466758049e2bc2449682512e00967dd9
Instruction ID: 4d45a383119a9d716bc2466c979e760d11c0d90a8e062d731e4a60b3c2ed0920
Opcode Fuzzy Hash: 50053cfbcc9b68c6da5f6124d336af52466758049e2bc2449682512e00967dd9
Instruction Fuzzy Hash: 03D10CB5A00701ABDB24EF24D896BEFBBA6FFC4300F10451DF94557282DB74A954C792

Function 0057F4C0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 270COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0057F65A

Strings

User, xrefs: 0058024C
User, xrefs: 0057F615

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: _strlen
String ID: User$User
API String ID: 4218353326-1540581059
Opcode ID: 083a5ee4973ab090cc2e686d1a30809b5fdd8b35a22cbf616e5a790b57692365
Instruction ID: d0d4175f9250d03ecf0084223bfdcb45b4ad365e021190642c5b7d031f9874e8
Opcode Fuzzy Hash: 083a5ee4973ab090cc2e686d1a30809b5fdd8b35a22cbf616e5a790b57692365
Instruction Fuzzy Hash: AE914470D003558BDB24EF68EC41AEDBBB1BF95304F04C169E84D67252EB34AAC4DBA5

Function 006E334E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 006E35C5

Strings

csm, xrefs: 006E35E7
csm, xrefs: 006E3658

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 73943f794ec689642fb91587f7bc9dd8baa7d65760d7d1dab13935aeb5ef7203
Instruction ID: f1041b3c20d877ed0b790277d1081ad235ac3aa7e2aa6bb81345343ca98b44fd
Opcode Fuzzy Hash: 73943f794ec689642fb91587f7bc9dd8baa7d65760d7d1dab13935aeb5ef7203
Instruction Fuzzy Hash: F131A3325023A5FBCF269F62C84C8AA7B67FB08715B14455AF8544B321D332CE62DF81

Function 00724150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 007241E0

Strings

CBc, xrefs: 00724154
CBc, xrefs: 00724158, 00724180, 007241C3

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID: ___std_exception_copy
String ID: CBc$CBc
API String ID: 2659868963-1073021173
Opcode ID: ff1515eae90bd19e21cbd0f34fb97c8221d5efb90f8fd5daab1b1157582bb998
Instruction ID: c390b36a0a083db66ca0db130c2b55cf60f0824acc0175ba123f669c6527a5f4
Opcode Fuzzy Hash: ff1515eae90bd19e21cbd0f34fb97c8221d5efb90f8fd5daab1b1157582bb998
Instruction Fuzzy Hash: 4011EFB0500308ABC7149F68E805EAABBE8FF49314B40842DF9589B702D7B9E545CFA4

Function 005F4370 Relevance: 5.2, Strings: 4, Instructions: 179COMMON

Download Yara Rule

Strings

(, xrefs: 005F4450
#, xrefs: 005F4458
@HO, xrefs: 005F45A6
tion, xrefs: 005F448F

Memory Dump Source

Source File: 00000000.00000002.3418098739.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.3418057137.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418413748.0000000000867000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.0000000000908000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418490381.000000000090D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.0000000000922000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418536132.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_dAYksbWyFS.jbxd

Similarity

API ID:
String ID: #$($@HO$tion
API String ID: 0-3735721828
Opcode ID: 243fdd61bdd63b0819108934594da8a037160649b447b55b9513b054b9423749
Instruction ID: 7c70f3bfb350226fdb7dd3138209a07f19e1e0f6c2bde150e626063d1c3dbba4
Opcode Fuzzy Hash: 243fdd61bdd63b0819108934594da8a037160649b447b55b9513b054b9423749
Instruction Fuzzy Hash: B661B3719083459FDB44EF28D495B6BBBE1BF88704F04492DF98997252EB34E948CB82

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dAYksbWyFS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: dAYksbWyFS.exePID: 6236, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: dAYksbWyFS.exePID: 6236, Parent PID: 4004COMMON

Non-executed Functions

Windows Analysis Report
dAYksbWyFS.exe