Edit tour

Windows Analysis Report
5vBN4LO7PH.exe

Overview

General Information

Sample name:	5vBN4LO7PH.exe renamed because original name is a hash value
Original sample name:	353aaedc333d9c8c63b741f0183ca0856355f8da.exe
Analysis ID:	1546809
MD5:	36afcebdc35386cfcc65b675b7788c08
SHA1:	353aaedc333d9c8c63b741f0183ca0856355f8da
SHA256:	49478ec269d224b2ff1dc745e6ff8053d3040f9c7e0338bb1a2049c380f1f5b9
Tags:	exeReversingLabsuser-NDA0E
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

5vBN4LO7PH.exe (PID: 4940 cmdline: "C:\Users\user\Desktop\5vBN4LO7PH.exe" MD5: 36AFCEBDC35386CFCC65B675B7788C08)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T16:05:23.355836+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.8	49704	TCP
2024-11-01T16:06:03.835592+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.8	51270	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 5vBN4LO7PH.exe

ReversingLabs: Detection: 89%

Machine Learning detection for sample

Source: 5vBN4LO7PH.exe

Joe Sandbox ML: detected

Source: 5vBN4LO7PH.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 5vBN4LO7PH.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: updater.exe.pdb source: 5vBN4LO7PH.exe

Source: C:\Users\user\Desktop\5vBN4LO7PH.exe

Code function: 4x nop then movd mm0, dword ptr [edx]

0_2_007043C0

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.8:51270
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.8:49704

Source: 5vBN4LO7PH.exe	String found in binary or memory: http://.css
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://.jpg
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://html4/loose.dtd
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://support.google.com/installer/
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://support.google.com/installer/%s?product=%s&error=%d
Source: 5vBN4LO7PH.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: 5vBN4LO7PH.exe	String found in binary or memory: https://clients2.google.com/cr/report
Source: 5vBN4LO7PH.exe	String found in binary or memory: https://crashpad.chromium.org/
Source: 5vBN4LO7PH.exe	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: 5vBN4LO7PH.exe	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: 5vBN4LO7PH.exe	String found in binary or memory: https://dl.google.com/update2/installers/icons/
Source: 5vBN4LO7PH.exe	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: 5vBN4LO7PH.exe	String found in binary or memory: https://update.googleapis.com/service/update2/json
Source: 5vBN4LO7PH.exe	String found in binary or memory: https://update.googleapis.com/service/update2/jsonhttps://clients2.google.com/cr/reporthttps://m.goo

Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00A580B0	0_2_00A580B0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00974080	0_2_00974080
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008AC040	0_2_008AC040
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_0089C050	0_2_0089C050
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00840060	0_2_00840060
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008801F0	0_2_008801F0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008B0150	0_2_008B0150
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00978170	0_2_00978170
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_0075C220	0_2_0075C220
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008CC230	0_2_008CC230
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00864300	0_2_00864300
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007544D0	0_2_007544D0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_0089C470	0_2_0089C470
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007EC540	0_2_007EC540
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00758590	0_2_00758590
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008D0690	0_2_008D0690
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00714640	0_2_00714640
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_0079C620	0_2_0079C620
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008A4640	0_2_008A4640
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00974660	0_2_00974660
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008147EC	0_2_008147EC
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007707E0	0_2_007707E0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00814730	0_2_00814730
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_009188C0	0_2_009188C0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_009A8830	0_2_009A8830
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00730880	0_2_00730880
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_0087C920	0_2_0087C920
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00840AF0	0_2_00840AF0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00898A20	0_2_00898A20
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00A6CA60	0_2_00A6CA60
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008ACA50	0_2_008ACA50
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00704A80	0_2_00704A80
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_009B8B90	0_2_009B8B90
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00974B80	0_2_00974B80
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008A0BA0	0_2_008A0BA0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCBFC	0_2_007DCBFC
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCBF4	0_2_007DCBF4
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008A4B10	0_2_008A4B10
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCBE0	0_2_007DCBE0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00824B30	0_2_00824B30
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00888CB0	0_2_00888CB0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCC44	0_2_007DCC44
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_0081CCC0	0_2_0081CCC0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCC3C	0_2_007DCC3C
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCC2C	0_2_007DCC2C
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCC14	0_2_007DCC14
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCC0C	0_2_007DCC0C
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008ECCF0	0_2_008ECCF0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCCC0	0_2_007DCCC0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCCB8	0_2_007DCCB8
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCCA8	0_2_007DCCA8
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCCA0	0_2_007DCCA0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCC8C	0_2_007DCC8C
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCC84	0_2_007DCC84
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCD74	0_2_007DCD74
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DCC84	0_2_007DCC84
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007F4D40	0_2_007F4D40
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00918DF0	0_2_00918DF0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00720D10	0_2_00720D10
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00800D50	0_2_00800D50
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_0070CD97	0_2_0070CD97
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008C4EA0	0_2_008C4EA0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_0081CEC0	0_2_0081CEC0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007ACE30	0_2_007ACE30
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00774E20	0_2_00774E20
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008C0E10	0_2_008C0E10
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00984E50	0_2_00984E50
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007A0F30	0_2_007A0F30
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_0073CF20	0_2_0073CF20
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007E4FD0	0_2_007E4FD0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_009BCF70	0_2_009BCF70
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_0074D030	0_2_0074D030
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00705010	0_2_00705010
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007550D0	0_2_007550D0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007591F0	0_2_007591F0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_009B9110	0_2_009B9110
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008B5130	0_2_008B5130
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008E5150	0_2_008E5150
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007E11A0	0_2_007E11A0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00801160	0_2_00801160
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007DD230	0_2_007DD230
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00749220	0_2_00749220
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_009212E0	0_2_009212E0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00729370	0_2_00729370
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_0085D320	0_2_0085D320
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008914D0	0_2_008914D0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00825410	0_2_00825410
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007994B0	0_2_007994B0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00751560	0_2_00751560
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008AD5E0	0_2_008AD5E0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_007FD5C0	0_2_007FD5C0
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_0070D297	0_2_0070D297
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_00708B97	0_2_00708B97
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_008D8C70	0_2_008D8C70

Source: 5vBN4LO7PH.exe

Static PE information: Resource name: RT_STRING type: CLIPPER COFF executable (VAX #) not stripped - version 71

Source: 5vBN4LO7PH.exe, 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameupdater.exe> vs 5vBN4LO7PH.exe
Source: 5vBN4LO7PH.exe	Binary or memory string: OriginalFilenameupdater.exe> vs 5vBN4LO7PH.exe

Source: 5vBN4LO7PH.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.winEXE@1/0@0/0

Source: 5vBN4LO7PH.exe

ReversingLabs: Detection: 89%

Source: 5vBN4LO7PH.exe	String found in binary or memory: http://support.google.com/installer/
Source: 5vBN4LO7PH.exe	String found in binary or memory: ..\..\chrome\updater\app\app_install_win.ccUpdate success.No updates.Updater error: http://support.google.com/installer/%s?product=%s&error=%d installation completed: error category[], error_code[], extra_code1[], completion_message[], post_install_launch_command_line[]oemSetOemInstallState failedStoreRunTimeEnrollmentToken failed
Source: 5vBN4LO7PH.exe	String found in binary or memory: https://dl.google.com/update2/installers/icons/
Source: 5vBN4LO7PH.exe	String found in binary or memory: Fhttps://update.googleapis.com/service/update2/jsonhttps://clients2.google.com/cr/reporthttps://m.google.com/devicemanagement/data/apihttps://dl.google.com/update2/installers/icons/enterprise_companion.mojom.EnterpriseCompanionReceive mojo replyReceive mojo message
Source: 5vBN4LO7PH.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: 5vBN4LO7PH.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: 5vBN4LO7PH.exe	String found in binary or memory: --help display this help and exit
Source: 5vBN4LO7PH.exe	String found in binary or memory: --help display this help and exit
Source: 5vBN4LO7PH.exe	String found in binary or memory: partition_alloc/address_space
Source: 5vBN4LO7PH.exe	String found in binary or memory: overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script>
Source: 5vBN4LO7PH.exe	String found in binary or memory: asennuksen: $1oError sa pag-install: Nag-apply ang administrator ng network mo ng Group Policy na pumipigil sa pag-install: $1
Source: 5vBN4LO7PH.exe	String found in binary or memory: Tapos na ang pag-install.
Source: 5vBN4LO7PH.exe	String found in binary or memory: Kanselahin ang Pag-install
Source: 5vBN4LO7PH.exe	String found in binary or memory: Error sa pag-install: $1
Source: 5vBN4LO7PH.exe	String found in binary or memory: isvaatimuksia.fHindi na-install dahil hindi natutugunan ng iyong computer ang mga minimum na requirement sa hardware.mL'installation a
Source: 5vBN4LO7PH.exe	String found in binary or memory: Inihinto ang Pag-install.
Source: 5vBN4LO7PH.exe	String found in binary or memory: $1-installeerder
Source: 5vBN4LO7PH.exe	String found in binary or memory: $1-Installationsprogramm
Source: 5vBN4LO7PH.exe	String found in binary or memory: $1-installatieprogramma
Source: 5vBN4LO7PH.exe	String found in binary or memory: $1-installasjonsprogram
Source: 5vBN4LO7PH.exe	String found in binary or memory: .:Asennusvirhe: Asennusprosessin aloittaminen ei onnistunut.?Error sa pag-install: Hindi nagsimula ang proseso ng installer.GErreur d'installation
Source: 5vBN4LO7PH.exe	String found in binary or memory: .LAsennusvirhe: Asennusohjelmaa ei suoritettu loppuun. Asennus on keskeytetty.LError sa pag-install: Hindi natapos ang installer. Na-abort ang pag-install.tErreur d'installation
Source: 5vBN4LO7PH.exe	String found in binary or memory: Ini-install...
Source: 5vBN4LO7PH.exe	String found in binary or memory: 3Asennus ei ole valmis. Haluatko varmasti perua sen?IHindi nakumpleto ang pag-install. Sigurado ka bang gusto mong kanselahin?9Installation non termin
Source: 5vBN4LO7PH.exe	String found in binary or memory: uudelleen.#Hindi na-install. Pakisubukan ulit.,
Source: 5vBN4LO7PH.exe	String found in binary or memory: isen virheen takia.FHindi na-install dahil sa isang internal na error sa server ng update.Q
Source: 5vBN4LO7PH.exe	String found in binary or memory: ei tueta.OError sa pag-install: Invalid o hindi sinusuportahan ang filename ng installer.fErreur d'installation
Source: 5vBN4LO7PH.exe	String found in binary or memory: ivityspalvelimella ei ole tiivistedataa sovelluksesta.\Hindi na-install dahil walang anumang data ng hash para sa application ang server ng update.p
Source: 5vBN4LO7PH.exe	String found in binary or memory: n versiota ei tueta.QHindi na-install dahil hindi sinusuportahan ang bersyong ito ng operating system.ZL'installation a
Source: 5vBN4LO7PH.exe	String found in binary or memory: maassa.AHindi na-install dahil pinaghihigpitan ang access sa bansang ito.=L'installation a
Source: 5vBN4LO7PH.exe	String found in binary or memory: Ituloy ang Pag-install
Source: 5vBN4LO7PH.exe	String found in binary or memory: Nakansela ang pag-install.
Source: 5vBN4LO7PH.exe	String found in binary or memory: n.\Salamat sa pag-install. Dapat mong i-restart ang lahat ng iyong browser bago gamitin ang $1.eMerci d'avoir install
Source: 5vBN4LO7PH.exe	String found in binary or memory: n.SSalamat sa pag-install. Dapat mong i-restart ang iyong browser bago gamitin ang $1.aMerci d'avoir install
Source: 5vBN4LO7PH.exe	String found in binary or memory: n.TSalamat sa pag-install. Dapat mong i-restart ang iyong computer bago gamitin ang $1.aMerci d'avoir install
Source: 5vBN4LO7PH.exe	String found in binary or memory: .4Asennus ei onnistu, palvelin ei tunnista sovellusta.9Hindi na-install, hindi kilala ng server ang application.=Installation impossible. Le serveur ne reconna
Source: 5vBN4LO7PH.exe	String found in binary or memory: onnistui, koska protokollaa ei tueta.BHindi na-install dahil sa error na hindi sinusuportahang protocol.K
Source: 5vBN4LO7PH.exe	String found in binary or memory: si Windows-versiota ei tueta.IHindi na-install dahil hindi sinusuportahan ang iyong bersyon ng Windows.V
Source: 5vBN4LO7PH.exe	String found in binary or memory: Naghihintay sa pag-install...

Source: 5vBN4LO7PH.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 5vBN4LO7PH.exe

Static file information: File size 5585447 > 1048576

Source: 5vBN4LO7PH.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x3d7800

Source: 5vBN4LO7PH.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: 5vBN4LO7PH.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 5vBN4LO7PH.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: updater.exe.pdb source: 5vBN4LO7PH.exe

Source: 5vBN4LO7PH.exe

Static PE information: real checksum: 0x546229 should be: 0x562a2e

Source: 5vBN4LO7PH.exe	Static PE information: section name: CPADinfo
Source: 5vBN4LO7PH.exe	Static PE information: section name: malloc_h

Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_009203BB push ecx; ret		0_2_009203CE
Source: C:\Users\user\Desktop\5vBN4LO7PH.exe	Code function: 0_2_0084951C push eax; retn 0008h		0_2_00849525

Source: C:\Users\user\Desktop\5vBN4LO7PH.exe

Code function: 0_2_0079C510 rdtsc

0_2_0079C510

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\5vBN4LO7PH.exe

Code function: 0_2_0079C510 rdtsc

0_2_0079C510

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\5vBN4LO7PH.exe

Code function: 0_2_00701000 cpuid

0_2_00701000

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	Path Interception	Path Interception	2 Obfuscated Files or Information	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
5vBN4LO7PH.exe	89%	ReversingLabs	Win32.Virus.Floxif
5vBN4LO7PH.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://html4/loose.dtd	5vBN4LO7PH.exe	false	unknown
http://support.google.com/installer/%s?product=%s&error=%d	5vBN4LO7PH.exe	false	unknown
https://crashpad.chromium.org/	5vBN4LO7PH.exe	false	unknown
http://.css	5vBN4LO7PH.exe	false	unknown
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	5vBN4LO7PH.exe	false	unknown
https://m.google.com/devicemanagement/data/api	5vBN4LO7PH.exe	false	unknown
http://.jpg	5vBN4LO7PH.exe	false	unknown
https://crashpad.chromium.org/bug/new	5vBN4LO7PH.exe	false	unknown
https://dl.google.com/update2/installers/icons/	5vBN4LO7PH.exe	false	unknown
http://support.google.com/installer/	5vBN4LO7PH.exe	false	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546809
Start date and time:	2024-11-01 16:04:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5vBN4LO7PH.exe renamed because original name is a hash value
Original Sample Name:	353aaedc333d9c8c63b741f0183ca0856355f8da.exe
Detection:	MAL
Classification:	mal52.winEXE@1/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 104
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 5vBN4LO7PH.exe, PID 4940 because there are no executed function
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: 5vBN4LO7PH.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.8082376325746985
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5vBN4LO7PH.exe
File size:	5'585'447 bytes
MD5:	36afcebdc35386cfcc65b675b7788c08
SHA1:	353aaedc333d9c8c63b741f0183ca0856355f8da
SHA256:	49478ec269d224b2ff1dc745e6ff8053d3040f9c7e0338bb1a2049c380f1f5b9
SHA512:	a59239ec370296909b7421d27d42c6f72116d00ffc53aa928e213a8db28e1cc36d12f21860e6e3607846f5829d57aaaa7ef0f403673de34df358fb5d7a0d53cc
SSDEEP:	98304:NcFdYcc8M9AE4MaqCWx/4c5UwNlxw0UVRuGXNRp45RK0wtIFC7Vjwizv:NcLYcp/E4oz94c5tC0UVDuC0wtIFC7JL
TLSH:	9E468C12F6A09170E5A23232B93D673E49363E339B358ADB86442CDC2FB47D1653935B
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.........."......x=..b........"...........@...........................U.....)bT...@...........................G.P.....G....

File Icon


Icon Hash:	2f232d67b7934633

Static PE Info

General

Entrypoint:	0x620680
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x670C89AA [Mon Oct 14 03:02:02 2024 UTC]
TLS Callbacks:	0x53b250, 0x61f580, 0x5060d0, 0x61ed10, 0x4a3500, 0x52b860
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	d01d67eb7b8fe5e4fc4c9e4ed4a1cb1a

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
jmp 00007F6488A4FEE2h
jmp 00007F6488B24CFDh
mov ecx, dword ptr [00882040h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F6488B24E86h
test esi, ecx
jne 00007F6488B24EA8h
call 00007F6488B24EB1h
mov ecx, eax
cmp ecx, edi
jne 00007F6488B24E89h
mov ecx, BB40E64Fh
jmp 00007F6488B24E90h
test esi, ecx
jne 00007F6488B24E8Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00882040h], ecx
not ecx
pop edi
mov dword ptr [00882080h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [0087BD70h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0087BCC8h]
xor dword ptr [ebp-04h], eax
call dword ptr [0087BCC0h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0087BE7Ch]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F6488B34B3Ah
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x47ad9f	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x47adf0	0x1a4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a1000	0x99320	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x53e000	0x2860	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x474e60	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x474bf0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3d9218	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x47b838	0x8a4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x47ad18	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3d7603	0x3d7800	6bf99ccc072eb6b0ab38449041b162f3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3d9000	0xa83a0	0xa8400	20e8cb664b2e39c72a4495207f79e050	False	0.36478309574665674	data	6.207134557049836	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x482000	0x1b724	0x6000	511a4682839cac54b665709579c9e1c2	False	0.13423665364583334	data	3.4305525777257166	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x49e000	0x175	0x200	07bf5c8b09259f0612960ce0ed90bda0	False	0.07421875	data	0.33872122993819864	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
CPADinfo	0x49f000	0x28	0x200	842689af09e7bf563672a4b43f1a2286	False	0.04296875	data	0.12227588125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
malloc_h	0x4a0000	0xb9	0x200	637f3b764567070a303fd288b3f0b16c	False	0.369140625	data	3.047583126549454	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4a1000	0x99320	0x99400	b8da5ef50f408e39b9a7dd352ef3a560	False	0.29167038387030997	DIY-Thermocam raw data (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 8589938688.000000	5.370731403497337	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x53b000	0x1e550	0x1e600	6d5dc01eee4e7be7e63641885797cc4b	False	0.6525286136831275	data	6.702974326392581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TYPELIB	0x4ac290	0x1f30	data	English	United States	0.3572144288577154
TYPELIB	0x4ae1c0	0x974	data	English	United States	0.34628099173553717
TYPELIB	0x4aeb38	0x5198	data	English	United States	0.2967732669475297
TYPELIB	0x4b3cd0	0x1fac	data	English	United States	0.35360138135175134
TYPELIB	0x4b5c80	0x984	data	English	United States	0.3464696223316913
TYPELIB	0x4b6608	0x5858	data	English	United States	0.2998761938450654
RT_BITMAP	0x4a7950	0x4678	Device independent bitmap graphic, 100 x 60 x 24, image size 18000, resolution 3780 x 3780 px/m	English	United States	0.020343680709534368
RT_ICON	0x4a51c0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192, 16 important colors	English	United States	0.6317567567567568
RT_ICON	0x4a52e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.5823699421965318
RT_ICON	0x4a5850	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640, 16 important colors	English	United States	0.5120967741935484
RT_ICON	0x4a5b38	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.5455776173285198
RT_ICON	0x4a63e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.36341463414634145
RT_ICON	0x4a6a48	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.42350746268656714
RT_DIALOG	0x4abfc8	0x204	data	English	United States	0.46124031007751937
RT_DIALOG	0x4ac1d0	0xc0	data	English	United States	0.5572916666666666
RT_STRING	0x4bc2d8	0xd0a	data	English	United States	0.4682444577591372
RT_STRING	0x4bcfe8	0xdd2	data	English	United States	0.38157150932730355
RT_STRING	0x4bddc0	0xc0c	data	English	United States	0.5239948119325551
RT_STRING	0x4be9d0	0xd3c	Targa image data - Color 1072 x 1093 x 32 +1083 +1075 "\257\0045\0044\004 "	English	United States	0.4542502951593861
RT_STRING	0x4bf710	0xbac	data	English	United States	0.499665327978581
RT_STRING	0x4c02c0	0x396	data	English	United States	0.6285403050108932
RT_STRING	0x4c0658	0x2dc	data	English	United States	0.4959016393442623
RT_STRING	0x4c0938	0x282	data	English	United States	0.7819314641744548
RT_STRING	0x4c0bc0	0x2be	data	English	United States	0.603988603988604
RT_STRING	0x4c0e80	0x2ce	data	English	United States	0.6782729805013927
RT_STRING	0x4c1150	0x1c6	data	English	United States	0.7026431718061674
RT_STRING	0x4c1318	0x1d6	data	English	United States	0.5808510638297872
RT_STRING	0x4c14f0	0x1f0	data	English	United States	0.7701612903225806
RT_STRING	0x4c16e0	0x1d8	data	English	United States	0.6334745762711864
RT_STRING	0x4c18b8	0x1ca	data	English	United States	0.7183406113537117
RT_STRING	0x4c1a88	0x21a	data	English	United States	0.6672862453531598
RT_STRING	0x4c1ca8	0x28e	data	English	United States	0.43577981651376146
RT_STRING	0x4c1f38	0x27c	data	English	United States	0.7468553459119497
RT_STRING	0x4c21b8	0x2ae	data	English	United States	0.6749271137026239
RT_STRING	0x4c2468	0x280	data	English	United States	0.6296875
RT_STRING	0x4c26e8	0x152	data	English	United States	0.7958579881656804
RT_STRING	0x4c2840	0xcc	data	English	United States	0.7401960784313726
RT_STRING	0x4c2910	0xd2	data	English	United States	0.8904761904761904
RT_STRING	0x4c29e8	0xea	data	English	United States	0.8974358974358975
RT_STRING	0x4c2ad8	0xe8	data	English	United States	0.7931034482758621
RT_STRING	0x4c2bc0	0x124	data	English	United States	0.8561643835616438
RT_STRING	0x4c2ce8	0x20c	Targa image data - RLE 1083 x 1103 x 32 +1077 +1075 "A\0045\004."	English	United States	0.601145038167939
RT_STRING	0x4c2ef8	0x21c	data	English	United States	0.6611111111111111
RT_STRING	0x4c3118	0x24c	data	English	United States	0.7261904761904762
RT_STRING	0x4c3368	0x1d2	data	English	United States	0.6609442060085837
RT_STRING	0x4c3540	0x200	data	English	United States	0.75
RT_STRING	0x4c3740	0x2ce	data	English	United States	0.564066852367688
RT_STRING	0x4c3a10	0x298	data	English	United States	0.6204819277108434
RT_STRING	0x4c3ca8	0x278	data	English	United States	0.7848101265822784
RT_STRING	0x4c3f20	0x2d2	Targa image data - Color 2379 x 2337 x 32 +2344 +2354 "8\011.\011M\011*\011(\011M\011(\011 "	English	United States	0.6481994459833795
RT_STRING	0x4c41f8	0x29a	data	English	United States	0.7087087087087087
RT_STRING	0x4c4498	0x488	data	English	United States	0.5198275862068965
RT_STRING	0x4c4920	0x476	data	English	United States	0.4956217162872154
RT_STRING	0x4c4d98	0x49c	data	English	United States	0.6466101694915254
RT_STRING	0x4c5238	0x456	data	English	United States	0.5540540540540541
RT_STRING	0x4c5690	0x3f8	data	English	United States	0.5974409448818898
RT_STRING	0x4c5a88	0x460	data	English	United States	0.575
RT_STRING	0x4c5ee8	0x4b4	data	English	United States	0.46677740863787376
RT_STRING	0x4c63a0	0x478	data	English	United States	0.6354895104895105
RT_STRING	0x4c6818	0x470	data	English	United States	0.5598591549295775
RT_STRING	0x4c6c88	0x41c	data	English	United States	0.5807984790874525
RT_STRING	0x4c70a8	0x426	data	English	United States	0.5790960451977402
RT_STRING	0x4c74d0	0x488	data	English	United States	0.45775862068965517
RT_STRING	0x4c7958	0x424	data	English	United States	0.6490566037735849
RT_STRING	0x4c7d80	0x42c	data	English	United States	0.5608614232209738
RT_STRING	0x4c81b0	0x43a	data	English	United States	0.6090573012939002
RT_STRING	0x4c85f0	0x43c	data	English	United States	0.6199261992619927
RT_STRING	0x4c8a30	0x59c	data	English	United States	0.435933147632312
RT_STRING	0x4c8fd0	0x500	Targa image data - Color 2379 x 2337 x 32 +2344 +2354 "\025\011@\011 "	English	United States	0.6640625
RT_STRING	0x4c94d0	0x59c	data	English	United States	0.5682451253481894
RT_STRING	0x4c9a70	0x536	data	English	United States	0.5907046476761619
RT_STRING	0x4c9fa8	0x8e6	data	English	United States	0.5258999122036875
RT_STRING	0x4ca890	0xc92	data	English	United States	0.3334369173399627
RT_STRING	0x4cb528	0xbf4	data	English	United States	0.5320261437908497
RT_STRING	0x4cc120	0xc5e	data	English	United States	0.48673404927353126
RT_STRING	0x4ccd80	0xcd8	data	English	United States	0.4382603406326034
RT_STRING	0x4cda58	0x92c	data	English	United States	0.5404599659284497
RT_STRING	0x4ce388	0x9ce	data	English	United States	0.3669322709163347
RT_STRING	0x4ced58	0x962	data	English	United States	0.5104079933388843
RT_STRING	0x4cf6c0	0x986	data	English	United States	0.5332239540607056
RT_STRING	0x4d0048	0x9d8	data	English	United States	0.4765873015873016
RT_STRING	0x4d0a20	0x8ec	data	English	United States	0.563922942206655
RT_STRING	0x4d1310	0xcc6	data	English	United States	0.382262996941896
RT_STRING	0x4d1fd8	0xca8	data	English	United States	0.4367283950617284
RT_STRING	0x4d2c80	0xcbe	data	English	United States	0.5076640098099325
RT_STRING	0x4d3940	0xd0c	data	English	United States	0.4224550898203593
RT_STRING	0x4d4650	0x8a6	data	English	United States	0.5519421860885275
RT_STRING	0x4d4ef8	0x256	data	English	United States	0.4983277591973244
RT_STRING	0x4d5150	0x260	data	English	United States	0.5444078947368421
RT_STRING	0x4d53b0	0x22e	data	English	United States	0.6505376344086021
RT_STRING	0x4d55e0	0x23a	data	English	United States	0.5333333333333333
RT_STRING	0x4d5820	0x288	data	English	United States	0.6388888888888888
RT_STRING	0x4d5aa8	0x7a6	data	English	United States	0.49284984678243104
RT_STRING	0x4d6250	0x820	data	English	United States	0.46923076923076923
RT_STRING	0x4d6a70	0x6be	data	English	United States	0.6292004634994206
RT_STRING	0x4d7130	0x7d8	data	English	United States	0.4960159362549801
RT_STRING	0x4d7908	0x636	data	English	United States	0.5943396226415094
RT_STRING	0x4d7f40	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x4d8020	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x4d8100	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x4d81e0	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x4d82c0	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x4d83a0	0x2c4	data	English	United States	0.634180790960452
RT_STRING	0x4d8668	0x30e	data	English	United States	0.45524296675191817
RT_STRING	0x4d8978	0x2b2	data	English	United States	0.6768115942028986
RT_STRING	0x4d8c30	0x318	data	English	United States	0.5732323232323232
RT_STRING	0x4d8f48	0x326	data	English	United States	0.6178660049627791
RT_STRING	0x4d9270	0x2da	data	English	United States	0.6328767123287671
RT_STRING	0x4d9550	0x362	data	English	United States	0.3972286374133949
RT_STRING	0x4d98b8	0x2f4	data	English	United States	0.6666666666666666
RT_STRING	0x4d9bb0	0x302	data	English	United States	0.5324675324675324
RT_STRING	0x4d9eb8	0x35a	data	English	United States	0.5722610722610723
RT_STRING	0x4da218	0x2ca	data	English	United States	0.6442577030812325
RT_STRING	0x4da4e8	0x2b0	data	English	United States	0.39098837209302323
RT_STRING	0x4da798	0x2ba	data	English	United States	0.670487106017192
RT_STRING	0x4daa58	0x2f0	data	English	United States	0.6316489361702128
RT_STRING	0x4dad48	0x2fa	data	English	United States	0.573490813648294
RT_STRING	0x4db048	0x2c2	data	English	United States	0.6147308781869688
RT_STRING	0x4db310	0x34c	data	English	United States	0.39691943127962087
RT_STRING	0x4db660	0x3a4	data	English	United States	0.5482832618025751
RT_STRING	0x4dba08	0x34c	data	English	United States	0.566350710900474
RT_STRING	0x4dbd58	0x372	data	English	United States	0.4580498866213152
RT_STRING	0x4dc0d0	0x2a4	data	English	United States	0.628698224852071
RT_STRING	0x4dc378	0x29a	data	English	United States	0.506006006006006
RT_STRING	0x4dc618	0x2b4	data	English	United States	0.5520231213872833
RT_STRING	0x4dc8d0	0x290	data	English	United States	0.6829268292682927
RT_STRING	0x4dcb60	0x274	data	English	United States	0.5589171974522293
RT_STRING	0x4dcdd8	0x25e	data	English	United States	0.6897689768976898
RT_STRING	0x4dd038	0x304	data	English	United States	0.5375647668393783
RT_STRING	0x4dd340	0x334	data	English	United States	0.5536585365853659
RT_STRING	0x4dd678	0x2e6	data	English	United States	0.6819407008086253
RT_STRING	0x4dd960	0x2fa	data	English	United States	0.5603674540682415
RT_STRING	0x4ddc60	0x274	data	English	United States	0.6449044585987261
RT_STRING	0x4dded8	0x33a	data	English	United States	0.5581113801452785
RT_STRING	0x4de218	0x37c	data	English	United States	0.5302690582959642
RT_STRING	0x4de598	0x2fe	data	English	United States	0.6945169712793734
RT_STRING	0x4de898	0x34c	data	English	United States	0.5592417061611374
RT_STRING	0x4debe8	0x31c	data	English	United States	0.6344221105527639
RT_STRING	0x4def08	0x464	data	English	United States	0.5729537366548043
RT_STRING	0x4df370	0x4d8	data	English	United States	0.46048387096774196
RT_STRING	0x4df848	0x3bc	data	English	United States	0.6527196652719666
RT_STRING	0x4dfc08	0x45e	data	English	United States	0.5330948121645797
RT_STRING	0x4e0068	0x44a	data	English	United States	0.5819672131147541
RT_STRING	0x4e04b8	0x10c	data	English	United States	0.8470149253731343
RT_STRING	0x4e05c8	0xc0	data	English	United States	0.7864583333333334
RT_STRING	0x4e0688	0xe6	StarOffice Gallery theme \372, 154195760 objects, 1st \356\020\333\020\320\020\340\020\324\020\321\020\320\020\010	English	United States	0.9304347826086956
RT_STRING	0x4e0770	0xce	data	English	United States	0.7766990291262136
RT_STRING	0x4e0840	0xe6	data	English	United States	0.8608695652173913
RT_STRING	0x4e0928	0x872	data	English	United States	0.543940795559667
RT_STRING	0x4e11a0	0xbf6	data	English	United States	0.3791639451338994
RT_STRING	0x4e1d98	0xa84	data	English	United States	0.5824665676077266
RT_STRING	0x4e2820	0xba8	data	English	United States	0.47989276139410186
RT_STRING	0x4e33c8	0xb46	data	English	United States	0.5246015246015246
RT_STRING	0x4e3f10	0x406	data	English	United States	0.629126213592233
RT_STRING	0x4e4318	0x216	data	English	United States	0.50187265917603
RT_STRING	0x4e4530	0x204	data	English	United States	0.7596899224806202
RT_STRING	0x4e4738	0x212	data	English	United States	0.6754716981132075
RT_STRING	0x4e4950	0x22c	data	English	United States	0.6151079136690647
RT_STRING	0x4e4b80	0x230	data	English	United States	0.6839285714285714
RT_STRING	0x4e4db0	0x2fe	data	English	United States	0.46344647519582244
RT_STRING	0x4e50b0	0x312	data	English	United States	0.6743002544529262
RT_STRING	0x4e53c8	0x2e8	data	English	United States	0.706989247311828
RT_STRING	0x4e56b0	0x2f0	data	English	United States	0.5651595744680851
RT_STRING	0x4e59a0	0x1ee	data	English	United States	0.7489878542510121
RT_STRING	0x4e5b90	0x2c0	data	English	United States	0.48579545454545453
RT_STRING	0x4e5e50	0x25e	data	English	United States	0.5429042904290429
RT_STRING	0x4e60b0	0x20c	data	English	United States	0.6717557251908397
RT_STRING	0x4e62c0	0x272	data	English	United States	0.5015974440894568
RT_STRING	0x4e6538	0x2e4	data	English	United States	0.6851351351351351
RT_STRING	0x4e6820	0x846	data	English	United States	0.40557129367327666
RT_STRING	0x4e7068	0x7b8	data	English	United States	0.4473684210526316
RT_STRING	0x4e7820	0x716	data	English	United States	0.5931642778390298
RT_STRING	0x4e7f38	0x7c4	data	English	United States	0.44969818913480886
RT_STRING	0x4e8700	0x65c	data	English	United States	0.5706388206388207
RT_STRING	0x4e8d60	0xa9e	data	English	United States	0.40066225165562913
RT_STRING	0x4e9800	0xa76	data	English	United States	0.39357729648991785
RT_STRING	0x4ea278	0x93c	data	English	United States	0.5376480541455161
RT_STRING	0x4eabb8	0xa4a	data	English	United States	0.43242217160212604
RT_STRING	0x4eb608	0x8b8	data	English	United States	0.5013440860215054
RT_STRING	0x4ebec0	0x238	data	English	United States	0.6355633802816901
RT_STRING	0x4ec0f8	0x1f2	data	English	United States	0.5120481927710844
RT_STRING	0x4ec2f0	0x1de	data	English	United States	0.7510460251046025
RT_STRING	0x4ec4d0	0x200	Targa image data - Color 1072 x 1078 x 32 +1083 +1075 "1\0040\0049\004=\0040\004."	English	United States	0.615234375
RT_STRING	0x4ec6d0	0x1d8	data	English	United States	0.6758474576271186
RT_STRING	0x4ec8a8	0x2fe	data	English	United States	0.6292428198433421
RT_STRING	0x4ecba8	0x376	data	English	United States	0.5079006772009029
RT_STRING	0x4ecf20	0x328	data	English	United States	0.681930693069307
RT_STRING	0x4ed248	0x34a	data	English	United States	0.5653206650831354
RT_STRING	0x4ed598	0x31e	data	English	United States	0.6290726817042607
RT_STRING	0x4ed8b8	0x5e4	data	English	United States	0.5663129973474801
RT_STRING	0x4edea0	0x836	data	English	United States	0.42055185537583256
RT_STRING	0x4ee6d8	0x68e	data	English	United States	0.6495828367103695
RT_STRING	0x4eed68	0x7c2	data	English	United States	0.5171198388721048
RT_STRING	0x4ef530	0x72c	data	English	United States	0.5620915032679739
RT_STRING	0x4efc60	0x4c8	data	English	United States	0.6111111111111112
RT_STRING	0x4f0128	0x57a	data	English	United States	0.43009985734664763
RT_STRING	0x4f06a8	0x4d6	data	English	United States	0.6639741518578353
RT_STRING	0x4f0b80	0x55a	data	English	United States	0.6197080291970803
RT_STRING	0x4f10e0	0x52c	data	English	United States	0.554380664652568
RT_STRING	0x4f1610	0x5d8	data	English	United States	0.608957219251337
RT_STRING	0x4f1be8	0x95a	data	English	United States	0.38345864661654133
RT_STRING	0x4f2548	0x876	data	English	United States	0.5198522622345337
RT_STRING	0x4f2dc0	0x800	data	English	United States	0.5810546875
RT_STRING	0x4f35c0	0x8ba	data	English	United States	0.486123545210385
RT_STRING	0x4f3e80	0x592	data	English	United States	0.6227208976157083
RT_STRING	0x4f4418	0x494	data	English	United States	0.39505119453924914
RT_STRING	0x4f48b0	0x414	data	English	United States	0.4272030651340996
RT_STRING	0x4f4cc8	0x44e	data	English	United States	0.5444646098003629
RT_STRING	0x4f5118	0x44a	data	English	United States	0.43169398907103823
RT_STRING	0x4f5568	0x4c0	data	English	United States	0.537828947368421
RT_STRING	0x4f5a28	0xa62	data	English	United States	0.41346877351392025
RT_STRING	0x4f6490	0xa88	data	English	United States	0.4328635014836795
RT_STRING	0x4f6f18	0x946	data	English	United States	0.5686604886267902
RT_STRING	0x4f7860	0xa5e	data	English	United States	0.45139412207987945
RT_STRING	0x4f82c0	0x70c	data	English	United States	0.5609756097560976
RT_STRING	0x4f89d0	0x14a	data	English	United States	0.6606060606060606
RT_STRING	0x4f8b20	0x136	data	English	United States	0.635483870967742
RT_STRING	0x4f8c58	0x112	data	English	United States	0.9051094890510949
RT_STRING	0x4f8d70	0x17a	data	English	United States	0.6084656084656085
RT_STRING	0x4f8ef0	0x104	data	English	United States	0.8961538461538462
RT_STRING	0x4f8ff8	0xb3a	data	English	United States	0.4826026443980515
RT_STRING	0x4f9b38	0xc7a	data	English	United States	0.40388227927363807
RT_STRING	0x4fa7b8	0xa4c	data	English	United States	0.571320182094082
RT_STRING	0x4fb208	0xb48	data	English	United States	0.4878808864265928
RT_STRING	0x4fbd50	0xa54	data	English	United States	0.5268532526475038
RT_STRING	0x4fc7a8	0xcf0	data	English	United States	0.5135869565217391
RT_STRING	0x4fd498	0xe28	data	English	United States	0.38051876379690946
RT_STRING	0x4fe2c0	0xd0c	data	English	United States	0.5586826347305389
RT_STRING	0x4fefd0	0xedc	data	English	United States	0.47003154574132494
RT_STRING	0x4ffeb0	0xe64	data	English	United States	0.503257328990228
RT_STRING	0x500d18	0x452	data	English	United States	0.6301989150090416
RT_STRING	0x501170	0x3f0	data	English	United States	0.4742063492063492
RT_STRING	0x501560	0x32a	data	English	United States	0.7358024691358025
RT_STRING	0x501890	0x34e	data	English	United States	0.5921985815602837
RT_STRING	0x501be0	0x39e	data	English	United States	0.6479481641468683
RT_STRING	0x501f80	0x6ce	data	English	United States	0.5597014925373134
RT_STRING	0x502650	0xa78	data	English	United States	0.37089552238805973
RT_STRING	0x5030c8	0x932	data	English	United States	0.5739167374681393
RT_STRING	0x503a00	0x9a8	data	English	United States	0.5234627831715211
RT_STRING	0x5043a8	0x9a4	data	English	United States	0.4813614262560778
RT_STRING	0x504d50	0x4bc	data	English	United States	0.6452145214521452
RT_STRING	0x505210	0x2aa	data	English	United States	0.5381231671554252
RT_STRING	0x5054c0	0x27c	data	English	United States	0.6839622641509434
RT_STRING	0x505740	0x2a4	data	English	United States	0.7144970414201184
RT_STRING	0x5059e8	0x2a0	data	English	United States	0.6502976190476191
RT_STRING	0x505c88	0x246	AmigaOS bitmap font "5\016*\016\025\0162\016#\016L\016\027\016 \0162\016"\016+\016%\0161\016\007\016\031", fc_YSize 26880, 8974 elements, 2nd "s", 3rd "e"	English	United States	0.738831615120275
RT_STRING	0x505ed0	0x214	data	English	United States	0.5921052631578947
RT_STRING	0x5060e8	0x23e	data	English	United States	0.6515679442508711
RT_STRING	0x506328	0x27e	data	English	United States	0.7523510971786834
RT_STRING	0x5065a8	0x21c	data	English	United States	0.6388888888888888
RT_STRING	0x5067c8	0x386	data	English	United States	0.6862527716186253
RT_STRING	0x506b50	0x8a0	data	English	United States	0.458786231884058
RT_STRING	0x5073f0	0x872	data	English	United States	0.49167437557816834
RT_STRING	0x507c68	0x7a4	data	English	United States	0.6492842535787321
RT_STRING	0x508410	0x83c	data	English	United States	0.50853889943074
RT_STRING	0x508c50	0x644	data	English	United States	0.6315461346633416
RT_STRING	0x509298	0x2c2	AmigaOS bitmap font "3\006*\006&\006F\006'\006A\006 ", fc_YSize 4294936073, 9990 elements, 2nd "\276\011\260\011 ", 3rd "r"	English	United States	0.5821529745042493
RT_STRING	0x509560	0x2f6	data	English	United States	0.5672823218997362
RT_STRING	0x509858	0x27a	data	English	United States	0.8028391167192429
RT_STRING	0x509ad8	0x2de	data	English	United States	0.6335149863760218
RT_STRING	0x509db8	0x276	data	English	United States	0.7126984126984127
RT_STRING	0x50a030	0x392	data	English	United States	0.5831509846827133
RT_STRING	0x50a3c8	0x3a8	data	English	United States	0.5160256410256411
RT_STRING	0x50a770	0x31c	data	English	United States	0.7273869346733668
RT_STRING	0x50aa90	0x386	Targa image data - Color 1072 x 1093 x 32 +1083 +1075 "\257\0049\004;\0044\004;\0048\0049\0043\004 "	English	United States	0.5986696230598669
RT_STRING	0x50ae18	0x334	data	English	United States	0.6487804878048781
RT_STRING	0x50b150	0xa24	data	English	United States	0.5161787365177196
RT_STRING	0x50bb78	0xbd6	data	English	United States	0.4062706270627063
RT_STRING	0x50c750	0xaf6	data	English	United States	0.5823235923022095
RT_STRING	0x50d248	0xc5a	data	English	United States	0.48007590132827327
RT_STRING	0x50dea8	0xc86	data	English	United States	0.5028072364316906
RT_STRING	0x50eb30	0x952	data	English	United States	0.5431684828164292
RT_STRING	0x50f488	0xabe	data	English	United States	0.3916363636363636
RT_STRING	0x50ff48	0xa8a	data	English	United States	0.5830244625648628
RT_STRING	0x5109d8	0xb78	data	English	United States	0.4887602179836512
RT_STRING	0x511550	0xb80	data	English	United States	0.5040760869565217
RT_STRING	0x5120d0	0x96a	data	English	United States	0.5439834024896265
RT_STRING	0x512a40	0xaa2	data	English	United States	0.39162380602498165
RT_STRING	0x5134e8	0xa86	data	English	United States	0.5783221974758723
RT_STRING	0x513f70	0xb70	data	English	United States	0.5215163934426229
RT_STRING	0x514ae0	0xb38	data	English	United States	0.4794568245125348
RT_STRING	0x515618	0x9c2	data	English	United States	0.5612489991993594
RT_STRING	0x515fe0	0xc0e	data	English	United States	0.41088788075178223
RT_STRING	0x516bf0	0xb3e	data	English	United States	0.5111188325225852
RT_STRING	0x517730	0xbac	data	English	United States	0.5471887550200804
RT_STRING	0x5182e0	0xb70	data	English	United States	0.48189890710382516
RT_STRING	0x518e50	0x84e	data	English	United States	0.5973659454374413
RT_STRING	0x5196a0	0x7c0	data	English	United States	0.4329637096774194
RT_STRING	0x519e60	0x7b4	data	English	United States	0.49898580121703856
RT_STRING	0x51a618	0x70c	data	English	United States	0.5909090909090909
RT_STRING	0x51ad28	0x7b0	data	English	United States	0.4949186991869919
RT_STRING	0x51b4d8	0x606	data	English	United States	0.6465629053177692
RT_STRING	0x51bae0	0x8a4	data	English	United States	0.4462025316455696
RT_STRING	0x51c388	0x8d8	data	English	United States	0.4620141342756184
RT_STRING	0x51cc60	0x786	data	English	United States	0.6246105919003115
RT_STRING	0x51d3e8	0x872	Targa image data - Color 2379 x 2337 x 32 +2344 +2354 "\027\0110\011?\011\017\011\025\011K\011 "	English	United States	0.48103607770582796
RT_STRING	0x51dc60	0x6f0	data	English	United States	0.5996621621621622
RT_STRING	0x51e350	0x896	data	English	United States	0.47952684258416745
RT_STRING	0x51ebe8	0x872	data	English	United States	0.4398704902867715
RT_STRING	0x51f460	0x77a	data	English	United States	0.6212121212121212
RT_STRING	0x51fbe0	0x824	data	English	United States	0.4923224568138196
RT_STRING	0x520408	0x6fc	data	English	United States	0.5956375838926175
RT_STRING	0x520b08	0xdc	data	English	United States	0.8772727272727273
RT_STRING	0x520be8	0xd8	data	English	United States	0.7407407407407407
RT_STRING	0x520cc0	0xcc	data	English	United States	0.9215686274509803
RT_STRING	0x520d90	0xf0	data	English	United States	0.7958333333333333
RT_STRING	0x520e80	0xca	data	English	United States	0.8712871287128713
RT_STRING	0x520f50	0x7da	data	English	United States	0.5084577114427861
RT_STRING	0x521730	0x97e	data	English	United States	0.4020576131687243
RT_STRING	0x5220b0	0x7ec	data	English	United States	0.5729783037475346
RT_STRING	0x5228a0	0x8ee	data	English	United States	0.47112860892388453
RT_STRING	0x523190	0x8ba	data	English	United States	0.517905102954342
RT_STRING	0x523a50	0x1f20	data	English	United States	0.38679718875502006
RT_STRING	0x525970	0x2b14	data	English	United States	0.2920747188973522
RT_STRING	0x528488	0x2756	CLIPPER COFF executable (VAX #) not stripped - version 71	English	United States	0.40625620655412115
RT_STRING	0x52abe0	0x2aee	data	English	United States	0.34795268425841674
RT_STRING	0x52d6d0	0x27b2	data	English	United States	0.37699271796890377
RT_STRING	0x52fe88	0xc1c	data	English	United States	0.4483870967741935
RT_STRING	0x530aa8	0x364	data	English	United States	0.3467741935483871
RT_STRING	0x530e10	0x32a	data	English	United States	0.5530864197530864
RT_STRING	0x531140	0x33e	data	English	United States	0.4867469879518072
RT_STRING	0x531480	0x330	data	English	United States	0.4215686274509804
RT_STRING	0x5317b0	0x340	data	English	United States	0.6153846153846154
RT_STRING	0x531af0	0x3ae	data	English	United States	0.4447983014861996
RT_STRING	0x531ea0	0x366	data	English	United States	0.6091954022988506
RT_STRING	0x532208	0x3b0	data	English	United States	0.6038135593220338
RT_STRING	0x5325b8	0x390	data	English	United States	0.5537280701754386
RT_STRING	0x532948	0x2f4	data	English	United States	0.6917989417989417
RT_STRING	0x532c40	0x332	Targa image data - RLE 1074 x 1072 x 32 +1072 +1082 "A\0045\004 "	English	United States	0.5158924205378973
RT_STRING	0x532f78	0x36c	data	English	United States	0.5901826484018264
RT_STRING	0x5332e8	0x376	data	English	United States	0.6557562076749436
RT_STRING	0x533660	0x33e	data	English	United States	0.5783132530120482
RT_STRING	0x5339a0	0x4b4	data	English	United States	0.6395348837209303
RT_STRING	0x533e58	0xba2	data	English	United States	0.40597716588314303
RT_STRING	0x534a00	0xc80	data	English	United States	0.4353125
RT_STRING	0x535680	0xb54	data	English	United States	0.5582758620689655
RT_STRING	0x5361d8	0xb5c	data	English	United States	0.4470426409903714
RT_STRING	0x536d38	0x9b8	data	English	United States	0.5542604501607717
RT_STRING	0x5376f0	0x86e	data	English	United States	0.4712696941612604
RT_STRING	0x537f60	0x8ec	data	English	United States	0.44089316987740806
RT_STRING	0x538850	0x7d2	data	English	United States	0.5934065934065934
RT_STRING	0x539028	0x7d4	data	English	United States	0.49650698602794413
RT_STRING	0x539800	0x748	data	English	United States	0.5574034334763949
RT_GROUP_ICON	0x4a78f0	0x5a	data	English	United States	0.7333333333333333
RT_VERSION	0x4bbe60	0x474	data	English	United States	0.44035087719298244
RT_MANIFEST	0x539f48	0x3d2	XML 1.0 document, ASCII text, with very long lines (864)	English	United States	0.5398773006134969

Imports

DLL	Import
ADVAPI32.dll	AddAce, AllocateAndInitializeSid, BuildExplicitAccessWithNameW, BuildSecurityDescriptorW, BuildTrusteeWithSidW, ChangeServiceConfig2W, ChangeServiceConfigW, CheckTokenMembership, CloseServiceHandle, ConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertStringSidToSidW, CopySid, CreateProcessAsUserW, CreateServiceW, DeleteService, DuplicateTokenEx, EqualSid, FreeSid, GetAce, GetAclInformation, GetLengthSid, GetNamedSecurityInfoW, GetSecurityDescriptorControl, GetSecurityDescriptorDacl, GetSecurityDescriptorGroup, GetSecurityDescriptorLength, GetSecurityDescriptorOwner, GetSecurityDescriptorSacl, GetSecurityInfo, GetSidIdentifierAuthority, GetSidLengthRequired, GetSidSubAuthority, GetSidSubAuthorityCount, GetTokenInformation, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, ImpersonateLoggedOnUser, ImpersonateNamedPipeClient, InitializeAcl, InitializeSecurityDescriptor, InitializeSid, IsValidAcl, IsValidSecurityDescriptor, IsValidSid, LookupAccountSidW, MakeAbsoluteSD, MakeSelfRelativeSD, OpenProcessToken, OpenSCManagerW, OpenServiceW, OpenThreadToken, QueryServiceConfigW, RegCloseKey, RegCreateKeyExW, RegDeleteKeyExW, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegOpenKeyExW, RegQueryInfoKeyW, RegQueryValueExA, RegQueryValueExW, RegSetValueExW, RegisterServiceCtrlHandlerW, RegisterTraceGuidsW, RevertToSelf, SetEntriesInAclW, SetNamedSecurityInfoW, SetSecurityDescriptorDacl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, SetSecurityInfo, SetServiceStatus, StartServiceCtrlDispatcherW, TraceEvent, UnregisterTraceGuids
dbghelp.dll	SymCleanup, SymFromAddr, SymGetLineFromAddr64, SymGetSearchPathW, SymInitialize, SymSetOptions, SymSetSearchPathW
GDI32.dll	BitBlt, CombineRgn, CreateCompatibleBitmap, CreateCompatibleDC, CreateFontIndirectW, CreateRectRgn, CreateRectRgnIndirect, CreateSolidBrush, DPtoLP, DeleteDC, DeleteObject, ExtTextOutW, FillRgn, GetDeviceCaps, GetObjectW, GetRegionData, GetStockObject, GetTextMetricsW, OffsetRgn, SelectObject, SetBkColor, SetTextColor, SetViewportOrgEx
MSIMG32.dll	GradientFill
OLEAUT32.dll	LoadRegTypeLib, LoadTypeLib, OleCreateFontIndirect, OleLoadPicturePath, SafeArrayAccessData, SafeArrayCreateVector, SafeArrayDestroy, SafeArrayGetDim, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayGetVartype, SafeArrayUnaccessData, SysAllocString, SysAllocStringByteLen, SysAllocStringLen, SysFreeString, SysStringLen, SystemTimeToVariantTime, VariantClear, VariantInit
SHELL32.dll	CommandLineToArgvW, SHGetFolderPathW, SHGetKnownFolderPath, ShellExecuteExW
USER32.dll	AllowSetForegroundWindow, BeginPaint, CallWindowProcW, CharNextW, CharUpperW, ClientToScreen, CopyImage, CopyRect, CreateAcceleratorTableW, CreateDialogIndirectParamW, CreateWindowExW, DefWindowProcW, DestroyAcceleratorTable, DestroyIcon, DestroyWindow, DispatchMessageW, EnableMenuItem, EnableWindow, EndDialog, EndPaint, EnumChildWindows, FillRect, FrameRect, GetActiveWindow, GetClassInfoExW, GetClassNameW, GetClientRect, GetCursorPos, GetDC, GetDesktopWindow, GetDlgItem, GetFocus, GetMenuState, GetMessageW, GetMonitorInfoW, GetParent, GetQueueStatus, GetSysColor, GetSysColorBrush, GetSystemMenu, GetSystemMetrics, GetTopWindow, GetWindow, GetWindowLongW, GetWindowRect, GetWindowTextLengthW, GetWindowTextW, InflateRect, InvalidateRect, InvalidateRgn, IsChild, IsDialogMessageW, IsMenu, IsRectEmpty, IsWindow, IsWindowVisible, KillTimer, LoadCursorW, LoadImageW, MapDialogRect, MapWindowPoints, MonitorFromWindow, MoveWindow, MsgWaitForMultipleObjectsEx, OffsetRect, PeekMessageW, PostMessageW, PostQuitMessage, PostThreadMessageW, RedrawWindow, RegisterClassExW, RegisterClassW, RegisterWindowMessageW, ReleaseCapture, ReleaseDC, ScreenToClient, SendDlgItemMessageW, SendMessageW, SetActiveWindow, SetCapture, SetDlgItemTextW, SetFocus, SetForegroundWindow, SetTimer, SetWindowContextHelpId, SetWindowLongW, SetWindowPos, SetWindowTextW, ShowWindow, SystemParametersInfoW, TranslateMessage, UnregisterClassW, UpdateWindow
KERNEL32.dll	AcquireSRWLockExclusive, AcquireSRWLockShared, AddVectoredExceptionHandler, AssignProcessToJobObject, CancelIo, CloseHandle, CompareStringW, ConnectNamedPipe, CopyFileW, CreateDirectoryW, CreateEventW, CreateFileA, CreateFileMappingW, CreateFileW, CreateIoCompletionPort, CreateMutexW, CreateNamedPipeW, CreatePipe, CreateProcessW, CreateSemaphoreW, CreateThread, CreateToolhelp32Snapshot, DecodePointer, DeleteCriticalSection, DeleteFileW, DeleteProcThreadAttributeList, DisconnectNamedPipe, DuplicateHandle, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExpandEnvironmentStringsW, FileTimeToLocalFileTime, FileTimeToSystemTime, FindClose, FindFirstFileExW, FindNextFileW, FindResourceExW, FindResourceW, FlushFileBuffers, FlushInstructionCache, FlushViewOfFile, FormatMessageA, FormatMessageW, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetComputerNameW, GetConsoleMode, GetConsoleOutputCP, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDateFormatW, GetDiskFreeSpaceExW, GetDriveTypeW, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesExW, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileSizeEx, GetFileTime, GetFileType, GetFullPathNameW, GetLastError, GetLocalTime, GetLocaleInfoW, GetLogicalProcessorInformation, GetLogicalProcessorInformationEx, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetNamedPipeClientProcessId, GetNamedPipeServerProcessId, GetNativeSystemInfo, GetOEMCP, GetProcAddress, GetProcessHeap, GetProcessId, GetProcessMitigationPolicy, GetProcessTimes, GetProductInfo, GetQueuedCompletionStatus, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemDefaultLCID, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetSystemTimePreciseAsFileTime, GetTempPathW, GetThreadContext, GetThreadId, GetThreadLocale, GetThreadPreferredUILanguages, GetThreadPriority, GetTickCount, GetTimeFormatW, GetTimeZoneInformation, GetUserDefaultLCID, GetUserPreferredUILanguages, GetVersionExW, GetWindowsDirectoryW, GlobalAlloc, GlobalFree, GlobalHandle, GlobalLock, GlobalMemoryStatusEx, GlobalUnlock, HeapAlloc, HeapDestroy, HeapFree, HeapReAlloc, HeapSetInformation, HeapSize, InitOnceExecuteOnce, InitializeConditionVariable, InitializeCriticalSection, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeProcThreadAttributeList, InitializeSListHead, InitializeSRWLock, InterlockedPopEntrySList, InterlockedPushEntrySList, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, IsWow64Process, K32GetModuleInformation, K32QueryWorkingSetEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExA, LoadLibraryExW, LoadLibraryW, LoadResource, LocalFree, LockFileEx, LockResource, MapViewOfFile, MoveFileExW, MoveFileW, MulDiv, MultiByteToWideChar, OpenProcess, OutputDebugStringA, OutputDebugStringW, PeekNamedPipe, PostQueuedCompletionStatus, Process32FirstW, Process32NextW, ProcessIdToSessionId, QueryFullProcessImageNameW, QueryPerformanceCounter, QueryPerformanceFrequency, QueryThreadCycleTime, RaiseException, ReadConsoleW, ReadFile, ReadProcessMemory, RegisterWaitForSingleObject, ReleaseMutex, ReleaseSRWLockExclusive, ReleaseSRWLockShared, ReleaseSemaphore, RemoveDirectoryW, RemoveVectoredExceptionHandler, ReplaceFileW, ResetEvent, ResumeThread, RtlCaptureStackBackTrace, RtlUnwind, SetConsoleCtrlHandler, SetCurrentDirectoryW, SetEndOfFile, SetEnvironmentVariableW, SetEvent, SetFileAttributesW, SetFileInformationByHandle, SetFilePointer, SetFilePointerEx, SetFileTime, SetHandleInformation, SetLastError, SetNamedPipeHandleState, SetProcessShutdownParameters, SetStdHandle, SetThreadInformation, SetThreadPriority, SetUnhandledExceptionFilter, SizeofResource, Sleep, SleepConditionVariableSRW, SleepEx, SuspendThread, SwitchToThread, SystemTimeToFileTime, SystemTimeToTzSpecificLocalTime, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TransactNamedPipe, TryAcquireSRWLockExclusive, TzSpecificLocalTimeToSystemTime, UnhandledExceptionFilter, UnlockFileEx, UnmapViewOfFile, UnregisterWaitEx, UpdateProcThreadAttribute, VerSetConditionMask, VerifyVersionInfoW, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, VirtualQueryEx, WTSGetActiveConsoleSessionId, WaitForMultipleObjects, WaitForSingleObject, WaitNamedPipeW, WakeAllConditionVariable, WakeConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile, lstrcmpW
ole32.dll	CLSIDFromProgID, CLSIDFromString, CoAddRefServerProcess, CoCreateGuid, CoCreateInstance, CoGetCallContext, CoGetClassObject, CoInitializeEx, CoInitializeSecurity, CoRegisterClassObject, CoRegisterInitializeSpy, CoReleaseServerProcess, CoResumeClassObjects, CoRevokeClassObject, CoRevokeInitializeSpy, CoSetProxyBlanket, CoTaskMemAlloc, CoTaskMemFree, CoUninitialize, CreateStreamOnHGlobal, IIDFromString, OleInitialize, OleLockRunning, OleUninitialize, StringFromGUID2
Secur32.dll	GetUserNameExW
WTSAPI32.dll	WTSEnumerateSessionsW, WTSFreeMemory, WTSQuerySessionInformationW
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, EnterCriticalPolicySection, LeaveCriticalPolicySection, UnloadUserProfile
COMCTL32.dll	InitCommonControlsEx, _TrackMouseEvent
WINHTTP.dll	WinHttpAddRequestHeaders, WinHttpCloseHandle, WinHttpConnect, WinHttpCrackUrl, WinHttpGetProxyForUrl, WinHttpOpen, WinHttpOpenRequest, WinHttpQueryHeaders, WinHttpReadData, WinHttpReceiveResponse, WinHttpSendRequest, WinHttpSetOption, WinHttpSetStatusCallback, WinHttpSetTimeouts, WinHttpWriteData
UxTheme.dll	SetWindowTheme
SHLWAPI.dll	PathMatchSpecW
ntdll.dll	NtDeleteKey, RtlGetLastNtStatus
WINMM.dll	timeBeginPeriod, timeEndPeriod, timeGetTime
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW
api-ms-win-core-winrt-l1-1-0.dll	RoInitialize, RoUninitialize

Exports

Name	Ordinal	Address
GetHandleVerifier	1	0x4f28a0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 16:05:25.501008987 CET	53	63929	1.1.1.1	192.168.2.8

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: 5vBN4LO7PH.exePID: 4940, Parent PID: 4084

General

Target ID:	0
Start time:	11:05:04
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\5vBN4LO7PH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5vBN4LO7PH.exe"
Imagebase:	0x700000
File size:	5'585'447 bytes
MD5 hash:	36AFCEBDC35386CFCC65B675B7788C08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 5vBN4LO7PH.exePID: 4940, Parent PID: 4084COMMON

Non-executed Functions

Function 00730880 Relevance: 16.4, APIs: 1, Strings: 7, Instructions: 2379COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00730B92

Strings

@]C, xrefs: 00731BCF
`YC, xrefs: 0073314F
`[C, xrefs: 007323FD
KC, xrefs: 007308DA
0kA, xrefs: 0073127A
\C, xrefs: 007316FF
OC, xrefs: 00730DA4

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: \C$0kA$@]C$`YC$`[C$KC$OC
API String ID: 885266447-1247463242
Opcode ID: 48b72d1c140b7613456c4b1be2d89aff4a6b1b6fdf4858aa58b0cd747d1cffbe
Instruction ID: ba93850ecb3329197907d5db52c1b4d5a29475e1b4e57a82cd2eba3fcbf5ee6b
Opcode Fuzzy Hash: 48b72d1c140b7613456c4b1be2d89aff4a6b1b6fdf4858aa58b0cd747d1cffbe
Instruction Fuzzy Hash: E833A3B19187818FE731CF24C5857EBB7E4BFD4314F544A2EE88993242EB74A585CB82

Function 0079C620 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 522COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0079C7BA
__aullrem.LIBCMT ref: 0079C7E4
__aulldiv.LIBCMT ref: 0079C7F8
__aullrem.LIBCMT ref: 0079C80F

Strings

0000, xrefs: 0079CA1A
0000, xrefs: 0079CAF4
0000, xrefs: 0079C8C7

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 0000$0000$0000
API String ID: 3839614884-429567252
Opcode ID: 1ab096504c0ecf574247b9bbef814fc513afa53f54957ed9f4834318bc3101a7
Instruction ID: e036b91f8e10bb3c14c9968cea6910ea901ce19a87a0b9d029d726af649315b4
Opcode Fuzzy Hash: 1ab096504c0ecf574247b9bbef814fc513afa53f54957ed9f4834318bc3101a7
Instruction Fuzzy Hash: 14029472F0160A4BDB0CCD68CD923AEFAEBEBC4310F19863DD525DB795EA7899018750

Function 00714640 Relevance: 8.1, APIs: 1, Strings: 3, Instructions: 1114COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 007148C3

Strings

`UA, xrefs: 007147BF
`VA, xrefs: 0071500D, 00715015
PA, xrefs: 00714B39

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: _strlen
String ID: `UA$`VA$PA
API String ID: 4218353326-3694647710
Opcode ID: 1424e6e06750c679cd12d11a53e780b00fdc1378cca842288c16d6c86a2320da
Instruction ID: dd58cb5fbf94e7252bdd575193385fdbf9eaff0faa53ae020147dfd47e1b7323
Opcode Fuzzy Hash: 1424e6e06750c679cd12d11a53e780b00fdc1378cca842288c16d6c86a2320da
Instruction Fuzzy Hash: ED82C3B1A043109FDB14DF28D885BAAB7E5BFC8710F04452DF98997381EB78AD45CB92

Function 00751560 Relevance: 7.9, Strings: 5, Instructions: 1682COMMON

Download Yara Rule

Strings

$, xrefs: 00751B56
|$K, xrefs: 00751B6F, 00751B88
#, xrefs: 00751B61
, xrefs: 0075306B
p8E, xrefs: 007528F5

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: #$$$p8E$|$K$
API String ID: 0-2562421713
Opcode ID: d3f5baa0e84579c5abf31b36b3e359547f380ae8a3382f26ef189eb7a91e9835
Instruction ID: 9f9050a942ac5e13d568b7607fa3f128ed91e625d6e954c8bfd4fee8a2b4fb4e
Opcode Fuzzy Hash: d3f5baa0e84579c5abf31b36b3e359547f380ae8a3382f26ef189eb7a91e9835
Instruction Fuzzy Hash: BBD2F6B19083809BD7309B249845BEFB7E4AFD5301F14482DFDC997292EBB99948C793

Function 007EC540 Relevance: 7.7, Strings: 5, Instructions: 1442COMMON

Download Yara Rule

Strings

base, xrefs: 007EC62D
anno, xrefs: 007EC8B1
on, xrefs: 007EC880
tati, xrefs: 007EC88A
D, xrefs: 007ED8F3

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: D$anno$base$on$tati
API String ID: 0-1232396891
Opcode ID: 1d1121b254ccc1ab8d9c849e424c8e07a1ea47cccedc8491ad906682d5773f88
Instruction ID: 82dd242f8eecec4873aaea743614d81e597b9954ba77b9828d10ed92612453c8
Opcode Fuzzy Hash: 1d1121b254ccc1ab8d9c849e424c8e07a1ea47cccedc8491ad906682d5773f88
Instruction Fuzzy Hash: 97C2F4B1A093819FD735DF25DC81BAAB7E5BFC9310F044A2DE88987241E775AD44CB82

Function 008147EC Relevance: 6.4, APIs: 4, Instructions: 387COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00814891

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID:
API String ID: 601868998-0
Opcode ID: 3a8b83e9302bf160e16c3f66b788a5d69c8e9fc2ee95708adbfb41db2011fed1
Instruction ID: d8cfcc3e11b1843e9eae09da5bae51f4062f0eb94b92ff95ee106c27be003a9a
Opcode Fuzzy Hash: 3a8b83e9302bf160e16c3f66b788a5d69c8e9fc2ee95708adbfb41db2011fed1
Instruction Fuzzy Hash: 0DE1B270E052299FDB14CFA8D881BEABBF9FF48318F195129D805EB251E734AD81CB51

Function 00749220 Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 716COMMON

Download Yara Rule

APIs

Part of subcall function 0088F820: _strlen.LIBCMT ref: 0088F82B

_strlen.LIBCMT ref: 0074967E
_strlen.LIBCMT ref: 007498A1

Strings

0kA, xrefs: 0074970B

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: _strlen
String ID: 0kA
API String ID: 4218353326-1559822312
Opcode ID: fb83c7660aa90b7322ce7227443a6a5fb8454ae3e4fd0c688543aa439f8679ea
Instruction ID: c839e0174cf1b7cb1d34f95e416edca8a6cc61916eb3a75e961b8bbcfd520520
Opcode Fuzzy Hash: fb83c7660aa90b7322ce7227443a6a5fb8454ae3e4fd0c688543aa439f8679ea
Instruction Fuzzy Hash: 5532E271A002189FDB14EF24DC95BAFB7B5BF89310F04456DE90997381EB38AE45CB92

Function 00801160 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 560COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0080147A

Strings

t=}, xrefs: 0080116F, 0080117E, 008011A2

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: __aulldiv
String ID: t=}
API String ID: 3732870572-3907345569
Opcode ID: f67f693a4b9b5c17dc74e3dbce1b812e2e7c237646a93e96e7cbc37be95cbb94
Instruction ID: b79f26d17d46525ada16d3a317367300483267669830adca8c19cf4d1ba0d905
Opcode Fuzzy Hash: f67f693a4b9b5c17dc74e3dbce1b812e2e7c237646a93e96e7cbc37be95cbb94
Instruction Fuzzy Hash: F112B071A083009BCB54CE28CC8572AB7E5FBC9764F198A2DF899E73D1D775D8058B82

Function 00774E20 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 521COMMON

Download Yara Rule

Strings

@KL, xrefs: 007751D9

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: @KL
API String ID: 0-3812413351
Opcode ID: 9448882eb451429262f669045e00c69e628a7e582afaf42815443c5b5304ebf9
Instruction ID: f9a7217098f5ebceea8721f3e9a7795b90780bff960be14715040c06a201178f
Opcode Fuzzy Hash: 9448882eb451429262f669045e00c69e628a7e582afaf42815443c5b5304ebf9
Instruction Fuzzy Hash: 34222AB1A00B449FDB20DF34C841BA6B7E4FF59354F048A3DE89A97682EBB4B544CB41

Function 00898A20 Relevance: 3.8, APIs: 2, Instructions: 803COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25489ccaa4848f2bdfd20b1ec4740252063acb031d8ec9cf794bc0e41de1e50
Instruction ID: 47039746ab9a13e70c9de5c72767507cb34a461d9884595a9228014cc3a4b1fd
Opcode Fuzzy Hash: d25489ccaa4848f2bdfd20b1ec4740252063acb031d8ec9cf794bc0e41de1e50
Instruction Fuzzy Hash: A0724871E0061ACBDF29DF58C8847A9F7B2FB49310F1881A9D95AA7351DB30AD85CF90

Function 008D0690 Relevance: 3.6, Strings: 2, Instructions: 1120COMMON

Download Yara Rule

Strings

0%], xrefs: 008D0AA6
0%], xrefs: 008D0B50

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: 0%]$0%]
API String ID: 0-1426048388
Opcode ID: da8ab24b41a0a9921e463eb7d1c9d8f36d6454b794aa11b92782d52c4dced85b
Instruction ID: 8cda55704e7f46c5c795c604135b9eba8740662e635b77ca0353bd7f59199af8
Opcode Fuzzy Hash: da8ab24b41a0a9921e463eb7d1c9d8f36d6454b794aa11b92782d52c4dced85b
Instruction Fuzzy Hash: 3C926C71A012199FDB18CFA4C594BADB7B2FF95314F28476AD806EB781D731AC42CB81

Function 008C0E10 Relevance: 3.5, APIs: 2, Instructions: 486COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 008C1155
__floor_pentium4.LIBCMT ref: 008C1369

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 56493be3f1701769363b906be7fad17b9146f901a1fa02a499fc951ea8410180
Instruction ID: 1d546bce17c06a8436fe7348bbe756f46abc6d3e69a757484060a0fc0adf01aa
Opcode Fuzzy Hash: 56493be3f1701769363b906be7fad17b9146f901a1fa02a499fc951ea8410180
Instruction Fuzzy Hash: 0CF1D931B106098BCF18DF65C8D5A2EB3B2FF85350718862DE916EB342EB35E9858B51

Function 0081CEC0 Relevance: 3.4, APIs: 2, Instructions: 419COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0081D209
__floor_pentium4.LIBCMT ref: 0081D2FD

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 6215e036adc3bd4ef165456134b3fb6cc6651a0a68a3a93a1fc5c82e623e7894
Instruction ID: ed82c2ba2f5266b2419a142df5ed13e4ae9ce2aeb1fa9932cb6dcf3afb20712c
Opcode Fuzzy Hash: 6215e036adc3bd4ef165456134b3fb6cc6651a0a68a3a93a1fc5c82e623e7894
Instruction Fuzzy Hash: DBE1C571A10B098BC719DF29C8806AAF3A6FFD9310B29C72AD419DB651E771E8C1C751

Function 00978170 Relevance: 3.4, APIs: 2, Instructions: 359COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0097829D
__aulldiv.LIBCMT ref: 009782F2

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 2d470de9cea8b04ac46f5935d765cf2493ff01b4cbb0ed4a1e03d11b9d35a5f3
Instruction ID: 6536835c55da94fd26e36f42fdfbbcf97dd310c150a7f391043ff6ad655e7f1f
Opcode Fuzzy Hash: 2d470de9cea8b04ac46f5935d765cf2493ff01b4cbb0ed4a1e03d11b9d35a5f3
Instruction Fuzzy Hash: F7D13F72A083118FC718CE2DC99072BF7E5BBC8754F198A2DF899A7351D674ED048B92

Function 008ECCF0 Relevance: 3.3, APIs: 2, Instructions: 315COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 008ECF5C

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 5b4bae6273a97f69765a72ab8c168584e9c6780efb93dfe7f06d726524a059cc
Instruction ID: d33c369bd964be8db64735e69f633c6fad3afe9c9544c906ed2543f20c34cdd1
Opcode Fuzzy Hash: 5b4bae6273a97f69765a72ab8c168584e9c6780efb93dfe7f06d726524a059cc
Instruction Fuzzy Hash: E1B10671F1464A8FCB19DF6AC88066EF7B2FF86310718862DD856E7240DB71AC42CB81

Function 009BCF70 Relevance: 3.2, Strings: 2, Instructions: 674COMMON

Download Yara Rule

Strings

0sk, xrefs: 009BD8F0
0sk, xrefs: 009BD941

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: 0sk$0sk
API String ID: 0-2198998019
Opcode ID: 98883bf496d96c1ee329f60cdb355b6389fc7f54dd54587cf49123d593bed652
Instruction ID: 38ed8d573ad4540fe8ca416b0720b857641c76f1188b5cc761ae33caa27588c6
Opcode Fuzzy Hash: 98883bf496d96c1ee329f60cdb355b6389fc7f54dd54587cf49123d593bed652
Instruction Fuzzy Hash: 465278759093818FD325CF24C494BEBBBE4BFD9310F14492EE8DA87242EB74A544CB92

Function 007550D0 Relevance: 3.1, Strings: 2, Instructions: 639COMMON

Download Yara Rule

Strings

PSE, xrefs: 007555A8
PjE, xrefs: 00755278, 007552F2, 00755318, 00755281

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: PSE$PjE
API String ID: 0-2130230082
Opcode ID: f7edc87f89bbdf7147255b24aaf3f38c8080d19383ae228f91debab48ab68568
Instruction ID: fc9991211dc7ce5ef458eb1eaa8bb36a51d05680932342cc823f1d59ef7dbb3f
Opcode Fuzzy Hash: f7edc87f89bbdf7147255b24aaf3f38c8080d19383ae228f91debab48ab68568
Instruction Fuzzy Hash: 0B22C1B1E006089FDB10EF68DC45AAEB7B4FF88711F184529F819A7241EB74A915CBD2

Function 008AD5E0 Relevance: 3.1, Strings: 2, Instructions: 636COMMON

Download Yara Rule

Strings

0sk, xrefs: 008ADED5
0sk, xrefs: 008ADF2A

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: 0sk$0sk
API String ID: 0-2198998019
Opcode ID: c3e73d05876bd3f0a7ef6ffc78b3a7b1e0311e10aa92ce7d227526f6a7835c9c
Instruction ID: 170b4be8d19ffab719b064714e3bcfb23e5c5eae110b0c4cc89c3264b25b0172
Opcode Fuzzy Hash: c3e73d05876bd3f0a7ef6ffc78b3a7b1e0311e10aa92ce7d227526f6a7835c9c
Instruction Fuzzy Hash: 184258719083818BD325CF24C885BEBBBE4BFD9314F04492EE9DAD7641EB74A544CB92

Function 007ACE30 Relevance: 3.0, Strings: 2, Instructions: 492COMMON

Download Yara Rule

Strings

pu{, xrefs: 007AD21F
pu{, xrefs: 007ACE7A, 007AD2F0, 007ACFB8, 007ACFDC, 007AD2E5, 007AD0A1, 007ACFBB

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: pu{$pu{
API String ID: 0-1255618503
Opcode ID: 7f0af342ae67761542c24edf31ef7c4bb150b02d905cb8712ef223209a80ab5b
Instruction ID: 8945b34f145de296ab4de8da1501b04e3b2bc25e4feb9ccb80c3490ba1544d7c
Opcode Fuzzy Hash: 7f0af342ae67761542c24edf31ef7c4bb150b02d905cb8712ef223209a80ab5b
Instruction Fuzzy Hash: 5F1291B1600B01DFD728DF29C495A66B7E1FF89310B148A2DD9978BB91E738F845CB80

Function 0075C220 Relevance: 2.6, APIs: 1, Instructions: 1082COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0075C582

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 1aaf6a8438356b9c1f8fca1ff1ae78ff4c7c073b249e78591e05b6e6e686408b
Instruction ID: 09d5f541ded00af227646c1681895e30bae8cbb8e22d3b24d71ca3da20178101
Opcode Fuzzy Hash: 1aaf6a8438356b9c1f8fca1ff1ae78ff4c7c073b249e78591e05b6e6e686408b
Instruction Fuzzy Hash: 028207B1E003889FDF11DF64C845BEEBBB4AF99314F044529FC456B252E7B8A988C791

Function 00A580B0 Relevance: 2.5, APIs: 1, Instructions: 977COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad327b56a6dbe95fed3bb9e3d9677497f84499b9ade3e436807036d5b23df033
Instruction ID: 2112a950f6fd7b219e15cd3d985577a85ec28a40390184e5964719ddbf1ae665
Opcode Fuzzy Hash: ad327b56a6dbe95fed3bb9e3d9677497f84499b9ade3e436807036d5b23df033
Instruction Fuzzy Hash: 4B9226B0A087418FC718CF29C49171ABBE1BFC9355F548A2DE8DA97351EB34E949CB42

Function 00840AF0 Relevance: 2.1, Strings: 1, Instructions: 879COMMON

Download Yara Rule

Strings

, xrefs: 00841071

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2fb24e907237bba27761d5f43cddd23d4ec474d7e4c6cd7fbdd7caf0465948b9
Instruction ID: c509a3fbb7e08c24115af9a88986b3f79a6a6823912f0e307d160ef4d4ac187c
Opcode Fuzzy Hash: 2fb24e907237bba27761d5f43cddd23d4ec474d7e4c6cd7fbdd7caf0465948b9
Instruction Fuzzy Hash: 13629F71A083098BDB14CF28C48472BB7E2FBD9394F198A2DE995D7391DB70DC458B82

Function 007E11A0 Relevance: 1.9, APIs: 1, Instructions: 418COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 007E1362

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 9dd7656547f749ffbfce6106f896be8888563715c940862d8e268b77c224d082
Instruction ID: 90bb66afc98ca3ff33fc65a5cfd94be190c8b186fbec58a7f574da43c710825b
Opcode Fuzzy Hash: 9dd7656547f749ffbfce6106f896be8888563715c940862d8e268b77c224d082
Instruction Fuzzy Hash: B6D12971A012449BDB14DF69C892BBFB7F6FF88300F44842DE516A7342EB39A905CB91

Function 008A4B10 Relevance: 1.9, APIs: 1, Instructions: 379COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008A4B41

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 79e819c802a019509b1a3497de4337821eb43f7094d6ae4ecd061cc0d057c7db
Instruction ID: c28180290954fb58fa1c813a125cb078e6a62fe1858d9caa16269acc33a08937
Opcode Fuzzy Hash: 79e819c802a019509b1a3497de4337821eb43f7094d6ae4ecd061cc0d057c7db
Instruction Fuzzy Hash: 20D1CF71E002089FDF14DFA4D884AADB7B6FFC9314F159229E806A7751DBB1AC02CB91

Function 008914D0 Relevance: 1.8, APIs: 1, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10e842a6a0adc6cddfb0521c80d75f0091efe3cf2fd7af5edc369e902015fa31
Instruction ID: 5059906d9cf7a11f1e8a59edd668995218a8c9addeb847d678764aa9a8ee3dea
Opcode Fuzzy Hash: 10e842a6a0adc6cddfb0521c80d75f0091efe3cf2fd7af5edc369e902015fa31
Instruction Fuzzy Hash: 28A1D532A042069BDF18DF68DC84BAE77A6FFC8350F19853DE949A73A0D7749845CB81

Function 00814730 Relevance: 1.8, APIs: 1, Instructions: 254COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00814891
_strlen.LIBCMT ref: 00814955

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: ___from_strstr_to_strchr_strlen
String ID:
API String ID: 1576176021-0
Opcode ID: 34e360ee258f8e4567d1a413c1b05f005c7d20801c2ff14ca689c05737edbdfd
Instruction ID: ec54832c36c562e66be581bcbcea4c657fa88d1d890e21aefdec74de564fcc6c
Opcode Fuzzy Hash: 34e360ee258f8e4567d1a413c1b05f005c7d20801c2ff14ca689c05737edbdfd
Instruction Fuzzy Hash: F991B170A042668FDB14CFA9C8907EABBB9FF89324F19512AD855EB255D730DD81CB80

Function 007E4FD0 Relevance: 1.7, Strings: 1, Instructions: 438COMMON

Download Yara Rule

Strings

PUN, xrefs: 007E5065, 007E5197, 007E506E, 007E51AA, 007E51BD

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: PUN
API String ID: 0-3310694948
Opcode ID: 78148104bee2fab6cc86933fbea4a5e887731f1fa3f2a74a646cb440959944bb
Instruction ID: ff93d4abb5d0a291f2b099d0c2efb0e676c0a8d42b0b8cc319a11278a12b5933
Opcode Fuzzy Hash: 78148104bee2fab6cc86933fbea4a5e887731f1fa3f2a74a646cb440959944bb
Instruction Fuzzy Hash: 3EF128706007449FC714EF29C881B6AB7E1FF89314F04462DF85AD7782EB78A855CB92

Function 008A4640 Relevance: 1.6, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

(F~, xrefs: 008A49CB, 008A49DF, 008A49EA, 008A4970, 008A4AF8

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: (F~
API String ID: 0-3632364274
Opcode ID: 1cfa943356885c9a0fb11366cacf622fdd5b6acb4d78e044a9226158c3edd772
Instruction ID: ca6378fa5308004d4300b0928afe74b6d6e30ade04091774fe742825e7147d8b
Opcode Fuzzy Hash: 1cfa943356885c9a0fb11366cacf622fdd5b6acb4d78e044a9226158c3edd772
Instruction Fuzzy Hash: 36D1A271E002189FDF15DFA4D884AAEB7B6FFCA314B148229E906E7751D7B1AC02CB51

Function 009A8830 Relevance: 1.6, Instructions: 1583COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08457998a1133be2b7fc95cd7c2efb205790b1c59f339214903a70cf67a5453b
Instruction ID: 171f894d9d487229beca7c2cc3890b276ed369748336c24916215677725b4f24
Opcode Fuzzy Hash: 08457998a1133be2b7fc95cd7c2efb205790b1c59f339214903a70cf67a5453b
Instruction Fuzzy Hash: 7BC29071A143459BD714DF28C888A1AB7E8FF89764F048A2DF895D7791EB70EC40CB92

Function 00974080 Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

, xrefs: 00974306

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 640cdbe721b7688ddf3ab0d85a423c803a1ab3ec82fe28105525b2c5276c45a8
Instruction ID: 6d970653511648dc092b1933b8da909e917c5130faefb06520c8854e64121452
Opcode Fuzzy Hash: 640cdbe721b7688ddf3ab0d85a423c803a1ab3ec82fe28105525b2c5276c45a8
Instruction Fuzzy Hash: 12A1ED76E002298FDF04CFA9C4906EEBBF2BF88310F568129E919B7351D774AD458B90

Function 00984E50 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

*{, xrefs: 00984F06, 00984F9D

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: *{
API String ID: 0-1284370432
Opcode ID: 94c0ac62e9567a24716fbc643f94a4a1bbf4a2e6c15c1c883728e620c2e12f21
Instruction ID: a1ecb22ef8a5e0b20a7cf4aa72814209d377faf0eff7b10797366e08a0bcd558
Opcode Fuzzy Hash: 94c0ac62e9567a24716fbc643f94a4a1bbf4a2e6c15c1c883728e620c2e12f21
Instruction Fuzzy Hash: A9415076D0162A9FDB04DFA9C8815AAF7B5FF5831471A8259D914B7301E734AD40CBD0

Function 007DCD74 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

0sk, xrefs: 007DCDC3

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: 0sk
API String ID: 0-89697895
Opcode ID: 7d60e1b47e7a1239584cff1ac6feaf31a36ecd88d4818890eba645fcfebaab71
Instruction ID: 0b774f48eb6da571833343e926322c4e66e6984db7b9d42ceeea6995f55c715e
Opcode Fuzzy Hash: 7d60e1b47e7a1239584cff1ac6feaf31a36ecd88d4818890eba645fcfebaab71
Instruction Fuzzy Hash: B5513521508BC641E3B2C63CC8097ABFED16B07334F188BADD1F9491D3DBA86259D386

Function 0087C920 Relevance: .9, Instructions: 856COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86cf6f03e5059a3bfb96cd40a13872361d297a0d19da719574c78d810a9862a
Instruction ID: fd1021c91853c7c06bcdd83cf61d48be0d062cbb0035be6541eeb73dc4931b1d
Opcode Fuzzy Hash: d86cf6f03e5059a3bfb96cd40a13872361d297a0d19da719574c78d810a9862a
Instruction Fuzzy Hash: B2721474600B018FD728CF28C491A66B7F2FF89314F148A2DD89A8BB96DB70F845CB51

Function 008801F0 Relevance: .8, Instructions: 769COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be808f0a261bc33a9db72ac6f7b16298fdd66f3b4a7760d1e10f8cbd046999ee
Instruction ID: ea403b6f7fb9ccbb2e37ccb16a8f41e9e46edf8bef413d639a468e1b0d1a736f
Opcode Fuzzy Hash: be808f0a261bc33a9db72ac6f7b16298fdd66f3b4a7760d1e10f8cbd046999ee
Instruction Fuzzy Hash: B0627E71A083458FD764EF14C890BAAB7E1FFD5304F148A2DE98997351DB70A989CF82

Function 0074D030 Relevance: .7, Instructions: 717COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b1b1b95da99fbf6e582fcdd9ab43dbc6bdcd982e71981a41a5079532fe183d
Instruction ID: a8640ad3024cc8ec5f8b6d43701517fe684b35fbd1cf4a34531230755ce07497
Opcode Fuzzy Hash: 39b1b1b95da99fbf6e582fcdd9ab43dbc6bdcd982e71981a41a5079532fe183d
Instruction Fuzzy Hash: 3D222771A002088FDB24DF64CC89BAEB7B5FF85310F044469E84AAB752EB74ED45CB91

Function 007F4D40 Relevance: .7, Instructions: 707COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1e5006e28270cfd1f681987999b9c792b11174c967cb9397112a8e906b3943
Instruction ID: 9fc8019f20b3922b0f4e8108a88b7055601d1e3e1751dc9570f0adf116902795
Opcode Fuzzy Hash: 7a1e5006e28270cfd1f681987999b9c792b11174c967cb9397112a8e906b3943
Instruction Fuzzy Hash: CB42D271604B099FD714CF28C884A7AB7E2FF88314F28856CEA459B396D779EC45CB81

Function 008A0BA0 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea79bc4d0def6fc1fc648eb0c2769e63afb1d0ef35195db9e7a9da5878628df
Instruction ID: 2565f1aa24ce6d837fab350afd911098377a8675d98711290c78c7354668577e
Opcode Fuzzy Hash: bea79bc4d0def6fc1fc648eb0c2769e63afb1d0ef35195db9e7a9da5878628df
Instruction Fuzzy Hash: 4232D271A046488FEF28CAA4C4946FDB7B2FF47314F64412AD416E7A91EB34AD85CF41

Function 007544D0 Relevance: .6, Instructions: 628COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b221494c22a5df48efad7f218b082ef70cc0f2490054213a826a575642fd73e8
Instruction ID: 290c4ebae7544a40502429114adbaa44591e4af9e89f130301c0e7ddd05fd697
Opcode Fuzzy Hash: b221494c22a5df48efad7f218b082ef70cc0f2490054213a826a575642fd73e8
Instruction Fuzzy Hash: A9F1B2B1B002089FDB04EF69D855AAFB7A9EF85715F004429EC05AB341EB78EA45C7A1

Function 008C4EA0 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b004d8d6c6e0f7ef44b80e7cba2c80ef86612a3f197272bab8e01084a28fe19a
Instruction ID: b21f1f5f9da6b92038e1eeadef2e384d79b2286b3391c75e0af3aec5f8ab5a51
Opcode Fuzzy Hash: b004d8d6c6e0f7ef44b80e7cba2c80ef86612a3f197272bab8e01084a28fe19a
Instruction Fuzzy Hash: CA2229B5E006199BCF18DFA8E894B9DB7B2FB98314F15412DE806E7351DB30AC81CB81

Function 00840060 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d081a922a98ec5b6bf17904418330293bec6dc92a649bf67bb62c9b066eaa560
Instruction ID: b682e05af39fc4cc7149d5f7f7cb054387b9009d8ba1cd47cd45c8f260d99c5c
Opcode Fuzzy Hash: d081a922a98ec5b6bf17904418330293bec6dc92a649bf67bb62c9b066eaa560
Instruction Fuzzy Hash: 7B12C535A087198FC724DE28C85032BB7D2FFD5354F19862CEA96CB291EA75DC458F82

Function 007FD5C0 Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 8b4a05c83dc6f0eff1b2bc9115281ec907d141ac3aeceb964a0606a5fe44a714
Instruction ID: 6f569bd26fe6301e2373eec024dd2a397b477e7c0abcd89439af13e20e8c644e
Opcode Fuzzy Hash: 8b4a05c83dc6f0eff1b2bc9115281ec907d141ac3aeceb964a0606a5fe44a714
Instruction Fuzzy Hash: 3E22E8B4A0020D9BCB24EF59D855BBDB7B3BF85300F04412DE906AB386DB79AC15CB91

Function 009B9110 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ca3d83ba01f5c1bb60889a2781fe0241861403917cbc400b04885df40d490c
Instruction ID: d97e1ec24a5831684744d74c649fb9a75614148c4148bfac28c6b186577a9d40
Opcode Fuzzy Hash: 74ca3d83ba01f5c1bb60889a2781fe0241861403917cbc400b04885df40d490c
Instruction Fuzzy Hash: D312DE72E10209AFDF10DFA4DD81AEEB7B9FF48324F144129EA15AB251E735A905CB90

Function 0073CF20 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 254d5354c98b8e9351ee34542178a6dba85cc6e9f347d031036e35c7d6a65dd0
Instruction ID: 84757a5e4e4ddd5fdc01da8c62ffad1aa61c15ce99b0b04557aab9856128e22f
Opcode Fuzzy Hash: 254d5354c98b8e9351ee34542178a6dba85cc6e9f347d031036e35c7d6a65dd0
Instruction Fuzzy Hash: 4DF1F671B003089BEB14EF64DC96BAF7765BF85300F040069F915AB392EB799D05CB92

Function 00758590 Relevance: .5, Instructions: 493COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 074d8e309a124f2a00572f94f1e27ee6490980836c135096195c55653cd34080
Instruction ID: 42636d68fcf431fa7c9f6c3fde6c46a074edd19446cc461150ff93c796ffd1d4
Opcode Fuzzy Hash: 074d8e309a124f2a00572f94f1e27ee6490980836c135096195c55653cd34080
Instruction Fuzzy Hash: 7712BE71A043419FD714DF24C884AAAB7F5FFC9300F148A1DF985AB212EB75E949CB92

Function 007707E0 Relevance: .5, Instructions: 492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711a7d8f853192b411ef97005eb8390dd9d9a3c3d8bed0ae5658a7879c609b8f
Instruction ID: 09323d17c17e7dbde33cca0317f57d28b5c39e05b24165a3baa89aab794a3f79
Opcode Fuzzy Hash: 711a7d8f853192b411ef97005eb8390dd9d9a3c3d8bed0ae5658a7879c609b8f
Instruction Fuzzy Hash: BCF15F75E006198BCF24CF69D8805AEB7F2EF88350B68C529E85AE7345E775BD41CB80

Function 008ACA50 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4705dbddae663a26dbe0b3522fd00269dfdf9bb7ad8f4d68e40b5b256de00c37
Instruction ID: a2b20079074bd4e276874dd1ea9beea865913a74d9ee73e2d6d15907abf0cc0f
Opcode Fuzzy Hash: 4705dbddae663a26dbe0b3522fd00269dfdf9bb7ad8f4d68e40b5b256de00c37
Instruction Fuzzy Hash: 98029271A0060ADFEB14CF58C884BAEB7B2FF4A314F148129E815EBB41E775AD51CB91

Function 008CC230 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c30d726c1e672159e311af01384e852fd3fde2638cee3a9f3936498125ee897
Instruction ID: b5aecb4868213b9058f0013bdd7b0c4b7d5075c7438b43cf66970339c5079896
Opcode Fuzzy Hash: 7c30d726c1e672159e311af01384e852fd3fde2638cee3a9f3936498125ee897
Instruction Fuzzy Hash: A002C171A0025A9FCF258F28CC90FE977B2FB59314F1481ADE95997292D731DA91CF80

Function 00704A80 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0143fbb01e4cb802368a0b9f9344aaf815a2c6f2a28245d16c8935a4c8e93d81
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 0143fbb01e4cb802368a0b9f9344aaf815a2c6f2a28245d16c8935a4c8e93d81
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Function 008B5130 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 614ce47c0447fdaf3fcc233d484c466b0225d0fded921b497991b9200775211e
Instruction ID: 27a456f3a3299f5c6e82fa8fa855fdf1ca553b83323e8de110e3ad6fb43f868c
Opcode Fuzzy Hash: 614ce47c0447fdaf3fcc233d484c466b0225d0fded921b497991b9200775211e
Instruction Fuzzy Hash: D4025BB1D00A099BDB24DF68D881BEEB7B5FF98314F244229E856E7351E730AD45CB81

Function 00720D10 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 050292c184a31d981aa4998fb52a5491434ac7ee24e632a2dffb91eb4971ba15
Instruction ID: 2563cdf300b5839c3dc2e7dce36a3818f8b9da550b70cd950c7a328382473d91
Opcode Fuzzy Hash: 050292c184a31d981aa4998fb52a5491434ac7ee24e632a2dffb91eb4971ba15
Instruction Fuzzy Hash: 71F1F271A083919BC720DF24D881BABB7F5BFD8310F04492DF98597282EB75E944CB92

Function 009B8B90 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca3423c67ac07ccd8761eecbc5a0ccdd8612bf8de5098bfbe295a78b0b5f4f8b
Instruction ID: 67c173ff7b4b978dfadf4d4bcbd7a0c2f4bd6380a4b1a44148c4289544aee0ac
Opcode Fuzzy Hash: ca3423c67ac07ccd8761eecbc5a0ccdd8612bf8de5098bfbe295a78b0b5f4f8b
Instruction Fuzzy Hash: A7F161B1A0016A8FDF24DF18CD80BEE737AFB88314F1441A9EA19A7245DB309E95CF54

Function 0089C470 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51df810cdb6a8d322c899584ba8650e9bee9ca12d9b3789630ec6673ca4de56d
Instruction ID: fca26132292d54d1556b746f372bc85f49c4947a235bcd16588388fe3ddfe9cd
Opcode Fuzzy Hash: 51df810cdb6a8d322c899584ba8650e9bee9ca12d9b3789630ec6673ca4de56d
Instruction Fuzzy Hash: B0E1D471E0421A8FDF14EE58C4806BEBBE1FB89354F298539D856EB381D735AD41CB90

Function 007A0F30 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c17d412f95ecbab249621a15edcf7230247a0e51b7fe7bb24fd9592d90244b
Instruction ID: cbd5d5227deff2d964ada53adbc6ed5f1e57ee64a8075071b31a23b9f21fff55
Opcode Fuzzy Hash: 42c17d412f95ecbab249621a15edcf7230247a0e51b7fe7bb24fd9592d90244b
Instruction Fuzzy Hash: 41E1CB71F007599FEB24CF28C881F79B7A1BBC9700F5046A9E649AB381D7789981CB91

Function 009188C0 Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d006a44c04b4fc77bf3afd4124177b50354b2e2463544c4a42f60a262b27695
Instruction ID: 84318ef63913cf6c1cc1706420769c6834b9637961933fa842d8b512eef4671a
Opcode Fuzzy Hash: 9d006a44c04b4fc77bf3afd4124177b50354b2e2463544c4a42f60a262b27695
Instruction Fuzzy Hash: A8E19571F0071D9BCB14CFA4C9846FEB7B6BF84300F248529E855AB255DF74A981EB90

Function 008B0150 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85761b58885ba7115d854ffce2690c1864f12aa2997fda452c04bed536352565
Instruction ID: 877396b295176eef95fc2714f01f8b40f01c4ab40291ea5477435b6366488ec7
Opcode Fuzzy Hash: 85761b58885ba7115d854ffce2690c1864f12aa2997fda452c04bed536352565
Instruction Fuzzy Hash: 1EE1B571E1041A8BCB48CF69EC606BAB7B3FBC9350F5F4179D602A73A1C634A911CB90

Function 00729370 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb25153537ff2c24764e2097563bbb9953cc7967fcc95dc4c5fddab0a33934e0
Instruction ID: 87ab3b997d61a513c3aaab5645a7f438563f2f78413513ee1d5f3375cbfd8aa3
Opcode Fuzzy Hash: cb25153537ff2c24764e2097563bbb9953cc7967fcc95dc4c5fddab0a33934e0
Instruction Fuzzy Hash: 38D1C771E002298FCF14DF69D880AAEBBF1FF98310F198129E919AB351E735D945CB90

Function 0070CD97 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60bddebb240f5cbe791d0f92cdf5bec08009a8e00653e4cdc73227f5089968d3
Instruction ID: 49a0ae98401bcba7e1417c3486b40d53b367e85da6295b43b1e4071028d97e6a
Opcode Fuzzy Hash: 60bddebb240f5cbe791d0f92cdf5bec08009a8e00653e4cdc73227f5089968d3
Instruction Fuzzy Hash: CEC156A0039F6685C7D3FB34951024BF3E0BFDA28DF400A4AD544D6865EB7FE94E6225

Function 00705010 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd09723fc643d0e2ee6b257d94cca0fce2373df82c73f826f93028f387d61145
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: dd09723fc643d0e2ee6b257d94cca0fce2373df82c73f826f93028f387d61145
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 0089C050 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7447d3ba9bd6cedfb6705822b4abe6379dc6893a32abf44b3c6f3b0ce8fe8c7b
Instruction ID: 0e7d28cb2aa8c01e787c988d79ee9cc9ba9cd1e6eff64122531f7d188df1951e
Opcode Fuzzy Hash: 7447d3ba9bd6cedfb6705822b4abe6379dc6893a32abf44b3c6f3b0ce8fe8c7b
Instruction Fuzzy Hash: 9AB12771B046258BCF14AF68C49067AB7E2FF84314F2CC62EE866DB381D672E940D784

Function 007591F0 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8daf0c02250d2fc385145a8082f96ea1274c29373b544a4ec516d1a9fc41794
Instruction ID: a02c5bce5386e72c636ba95a5b79ec003fc95a5d5327e5a6d2dbb3853b0d3115
Opcode Fuzzy Hash: d8daf0c02250d2fc385145a8082f96ea1274c29373b544a4ec516d1a9fc41794
Instruction Fuzzy Hash: FE71E1B1B10118DB8B04EF69D815EAFBBB6AFC5711B41802DED099B341EB78ED058BD0

Function 0085D320 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331b9fecf1aa53ec451e2b68a97efa3ac4f9280de6ad7d6a5cea32097d0f2668
Instruction ID: 4fa9dd0b744e634f7895908285ae014b66a3b6204d1e8f10ac49fcd05bd76800
Opcode Fuzzy Hash: 331b9fecf1aa53ec451e2b68a97efa3ac4f9280de6ad7d6a5cea32097d0f2668
Instruction Fuzzy Hash: B5914872F0020A4FDB18CE68CC812AEB7AAFBC5314F29C23DDC16DB395E67599058791

Function 00888CB0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e205f1bccbd774c2785ad2d01b44a83b1778a47ae189fe899dd25d3394b6e2c7
Instruction ID: 74d8267d5bf00381e599007f01f0e99fdbf1c345d11f832305fba9407cd0aa1a
Opcode Fuzzy Hash: e205f1bccbd774c2785ad2d01b44a83b1778a47ae189fe899dd25d3394b6e2c7
Instruction Fuzzy Hash: D3B16C71A00218DFDB25EFA4D884BADBBB2FF88314F554059E905AB392CF70AC45CB81

Function 007DD230 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df5af0ae64c8e64c9c1ea7f4c95a47e42975ad62a90c8c928f8f30ace606b32
Instruction ID: b0bbe4c192b38962634596e56eb8ca3cd73ef775eea3a1befed1ee3333067c58
Opcode Fuzzy Hash: 5df5af0ae64c8e64c9c1ea7f4c95a47e42975ad62a90c8c928f8f30ace606b32
Instruction Fuzzy Hash: 1F91E771D0031897DF209BA09D42BEEB778AF54704F044166FD08EA382E679EE94CB92

Function 008E5150 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7addc1c521c5c8eda81d35379689a8a776ce367b4e26d89414df67e50ca395c2
Instruction ID: a85e0c01d3d58bee2dcdf5eb1fe286c78f1d7805c4904e377a2c89dfb20de63e
Opcode Fuzzy Hash: 7addc1c521c5c8eda81d35379689a8a776ce367b4e26d89414df67e50ca395c2
Instruction Fuzzy Hash: 3B91D6B1B006489FCB18DF29C895A6EB7E5FF99308F14442DE946CB352DB70E845CB92

Function 00974B80 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 048a1544127eb863cbf1ee132be3318a56503cbb61e6a9548af48d75623ec2d6
Instruction ID: 02895d38c7fb3ae7e776933f5bd81c9177b68b94c9d18bef05b5649cd67e8216
Opcode Fuzzy Hash: 048a1544127eb863cbf1ee132be3318a56503cbb61e6a9548af48d75623ec2d6
Instruction Fuzzy Hash: 9E918F75E006498FCB04DF69C4905EEBBF6EFD9310F24856DE949AB381DB349D418BA0

Function 00864300 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d386023969573d924522907f578b1ed914b877e69a8c4d292a7d1b98ee4f8ca
Instruction ID: 36d9e7832f54a01c84fc66d35f66d9d4f60efe0acd2ba8bc702f9b7a32efdb64
Opcode Fuzzy Hash: 0d386023969573d924522907f578b1ed914b877e69a8c4d292a7d1b98ee4f8ca
Instruction Fuzzy Hash: 19916076E0022D8BDB04CEA5C8D17AEB7F2FB88344F26952AC856E7341D7759C46CB90

Function 00A6CA60 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d4055ea0dd93a5e4ddfb2a6834c8554ff312a4500d0bb7dc4cc1858d8365c5
Instruction ID: 0f264728e47ca15ba7848d2687e0e75a89fb47b7e8653bd23b8528f1e3fffc8d
Opcode Fuzzy Hash: 62d4055ea0dd93a5e4ddfb2a6834c8554ff312a4500d0bb7dc4cc1858d8365c5
Instruction Fuzzy Hash: 93711771F042158BEF09DA29C88637EB7F2AFC5360F19C169C8999B1C5DA38CD46C780

Function 007994B0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0078fc5b8e532c983cc823b3ee52868facf853f6a4f092ed1a13f4e4258b42ee
Instruction ID: cbf7b7bbdc8beb250f3e294f969a565f64c0790f46de3d16850f394df73bf24f
Opcode Fuzzy Hash: 0078fc5b8e532c983cc823b3ee52868facf853f6a4f092ed1a13f4e4258b42ee
Instruction Fuzzy Hash: CF81D3B0A007058BDB34DF39E845BD7B7E5BF95304F00892DEA9A8B241EB75B845CB90

Function 00825410 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed9e27496ef2363085190919f1937942ab3aef27b6c65373d05c92e04e365ec3
Instruction ID: b9eded6ac5dbb26720c6eb157d0086efa5de77ecbcc1f24944f2229fd30fb100
Opcode Fuzzy Hash: ed9e27496ef2363085190919f1937942ab3aef27b6c65373d05c92e04e365ec3
Instruction Fuzzy Hash: 7E813470A04B468BD724DF35E89076BB7E2FFA1304F548A2DD48A9B341E731A895CB91

Function 00824B30 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511d27d98e9dcb5f8ed8c9e96c3334453a48d0d571cef75587f49586a8215742
Instruction ID: 7ead16a5555b3a5ef38c1f8957e31fd8a642ced43656de056f567526ab5c5312
Opcode Fuzzy Hash: 511d27d98e9dcb5f8ed8c9e96c3334453a48d0d571cef75587f49586a8215742
Instruction Fuzzy Hash: 1F61D3B0E002198BDB14EF69E895B6AB3E5FB84314F04852DE816D7382E734EC55CBE1

Function 008AC040 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f20a03df41510bcfb50170672aee766a40c79add5b526a82a31ef4102bd846
Instruction ID: 6536a8deab802d7cad10a6d529259d55567c388dea3b804364a50942335a052c
Opcode Fuzzy Hash: c5f20a03df41510bcfb50170672aee766a40c79add5b526a82a31ef4102bd846
Instruction Fuzzy Hash: D551C772F046298BDF08CE69C8506BEB7B2FF86314F15822DD826EB791D73599018B90

Function 0081CCC0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57249686381b9be15d7b30b6527841b4e9fc94310781afe8e5e0f900a84acfc3
Instruction ID: c2133655fc8e91fb11b382cf261e4042918f36bf75efe2e482f393a051db3487
Opcode Fuzzy Hash: 57249686381b9be15d7b30b6527841b4e9fc94310781afe8e5e0f900a84acfc3
Instruction Fuzzy Hash: 2F41B072B806198B8F14CE28DC856EEBBABFF947547588079E406DB245EB30DC81C791

Function 00918DF0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a45b989377ad67b22814d439d0f61c8c0036e5bacd23822f313d599b9c48be50
Instruction ID: b42abf6969d51a9e95f65543effbac23f9b184f91af290c3b26c0a1f06a949c3
Opcode Fuzzy Hash: a45b989377ad67b22814d439d0f61c8c0036e5bacd23822f313d599b9c48be50
Instruction Fuzzy Hash: AD517231E001898BDF21DB64C8446FFBBA6BF89314F698159D4556B241DB36ADC2DBC0

Function 00800D50 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4372d666fb2d74be3590e2aba95fa6ab52283937366472c64c620041f2e01dd
Instruction ID: 3d97d0ec2546aac58a2c47fd8f78e01e258a3d5611ac16005a29f8c6adcc5053
Opcode Fuzzy Hash: a4372d666fb2d74be3590e2aba95fa6ab52283937366472c64c620041f2e01dd
Instruction Fuzzy Hash: E641F4B0A007098BD360AF69DC94B26B7A6FB81304F54862DE846DB3D2D731F819CB91

Function 007DCBE0 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48793b046803fcbdefe320325b665b62c762a931ba271d874c688ac7c876da9
Instruction ID: befa9c98f0a6c8b14dc8d015cd7125449ebcd4659c52a8945069cca043d8a4cb
Opcode Fuzzy Hash: b48793b046803fcbdefe320325b665b62c762a931ba271d874c688ac7c876da9
Instruction Fuzzy Hash: F7510520508BC642E372873CC9097ABFFD16F06338F088B9DD5E9191D3DBA86259C386

Function 00974660 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c401a388fd1de5af855952d782a97c9c0199e026b6780a4b49fe8b4b17bef7e
Instruction ID: 40800f698b6ab40aacf9561316dee98b5b8e40404783d4807b50654c30c319f9
Opcode Fuzzy Hash: 3c401a388fd1de5af855952d782a97c9c0199e026b6780a4b49fe8b4b17bef7e
Instruction Fuzzy Hash: C63148A3E15A6286C3148B798848277F367BFD5311B278369E86C1B392F7348541C3D0

Function 007DCBFC Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5055f9085c8a38856ebe27a9865663d80ff47acef2b150d51c615a98040653
Instruction ID: 43b9037c9e4eb7cf80f837cefc1e15873f80a31eacca78050d52f0796db8727d
Opcode Fuzzy Hash: 7f5055f9085c8a38856ebe27a9865663d80ff47acef2b150d51c615a98040653
Instruction Fuzzy Hash: 0651C211548BC642E3B2863CC90979BFED16B06238F088B9DC5F9190D3DBA8625AD386

Function 007DCBF4 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294a451ee2261589851515c518981690cb524dca02669ff7840deeb0226f57cc
Instruction ID: 118f66efc328cffb0b74e55631e9ca8cab851a3dc1a33e9e90ab10b8cd24fe21
Opcode Fuzzy Hash: 294a451ee2261589851515c518981690cb524dca02669ff7840deeb0226f57cc
Instruction Fuzzy Hash: D851C311908BC641E3B2873CC9097ABFF916F06338F08CB9DD5F9191D3DBA86259C286

Function 007DCC2C Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90661c32c151e791090cb64b0e8a750873bafa02a06edfcc8469da794ad38e1e
Instruction ID: 184e6643b6c9e062a23e2016091d98df83630a01addd6d8edc4385a1221ab785
Opcode Fuzzy Hash: 90661c32c151e791090cb64b0e8a750873bafa02a06edfcc8469da794ad38e1e
Instruction Fuzzy Hash: 4641E221508BC641F3B2863DD80975BFED12B07338F088B9DC1F9095E3DBA86259D386

Function 007DCC0C Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59e977f553d17476994e07bdd85e327309b412815664a8bf3413cede639c57b
Instruction ID: 377190f8aa0323b4f4cd20480ee1f2b10b788646662c0e475b2dce97d8b7e493
Opcode Fuzzy Hash: d59e977f553d17476994e07bdd85e327309b412815664a8bf3413cede639c57b
Instruction Fuzzy Hash: EB41C211508BC641E3B2863DD90979BEED16B07238F088B9DD1F9191D3DBA8625AD386

Function 007DCC14 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d8a596ffe0877c5dff52f6cf198429530788d0fb3154b08abbe359268a85d0
Instruction ID: 6f0dc56b803b4f51320b14c49c64aa08fc9d43895be245323298120a5e8cd42d
Opcode Fuzzy Hash: 33d8a596ffe0877c5dff52f6cf198429530788d0fb3154b08abbe359268a85d0
Instruction Fuzzy Hash: C341C121548BC641F3B2863DD90975BFED16B07338F088B9DC1F9095D3DBA8625AD386

Function 007DCC3C Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 914ae1d49cca09f9766572ef2d5b77204b3354e536806faba6776c45252904cf
Instruction ID: 5c9396af480f1cc5b4cf37c0b937b16fdfe48afebecbc4bbd273f3c270b24b45
Opcode Fuzzy Hash: 914ae1d49cca09f9766572ef2d5b77204b3354e536806faba6776c45252904cf
Instruction Fuzzy Hash: 0B41EF21548BC641F3B2863CD90975BFED12B07238F08CB9D81F9095E3DBA9A259D386

Function 00701000 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b31c6e1e5518d89014befebaf7ed6d128ec61848a8d1619b4280668b8b5592
Instruction ID: 2524afccf01508014036540b944157b23f9c34c754f59aba92ab9e8ce9d2b1c9
Opcode Fuzzy Hash: 42b31c6e1e5518d89014befebaf7ed6d128ec61848a8d1619b4280668b8b5592
Instruction Fuzzy Hash: 6A31CEB4A00204CBEB44CF19C4D0B82BBE2BF98350F58C2B9DC4C8F35AD77599558BA2

Function 009212E0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: d2550b82f050bac34b5426de2dc8adb6749b5100fa2f833d0e38f49fefda9319
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 341108B72040A243D714CA2DF8B45FAA3AFEBE532076D437AD0414BE5CD222D9769640

Function 007DCC44 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd643f844363081e8833c0c34b429a59e4eabb15d2c161f1b488af85e57b344
Instruction ID: 4bbb0b18ce8609b9e16774a1d6dfe940b8c61cbbcb5d5c3b93e45bb8ee1a5474
Opcode Fuzzy Hash: dcd643f844363081e8833c0c34b429a59e4eabb15d2c161f1b488af85e57b344
Instruction Fuzzy Hash: B741E020548BC641F3B2863CC90975BFED16B07238F08CB9DC1F9095E3DBA9A259D386

Function 007DCC84 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e3a1822ed03bbb948cd709506edb353ad28dbc293863358474f38099c839523
Instruction ID: 9b3bd71ea470f234ec9896ed51f7ac1de44f31381579770327a48866baed943a
Opcode Fuzzy Hash: 1e3a1822ed03bbb948cd709506edb353ad28dbc293863358474f38099c839523
Instruction Fuzzy Hash: 0A212720508BC642E3A6873DC909797FFD06B06334F08CBADD1FA095D3DBA8A255C382

Function 007DCC8C Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ebaec09ba5177b595419b430e3d067e2b60e004ee5a1da4fa3f34ec1b44f95
Instruction ID: d5b8951e9a9076d6015733e5c9258507ecaab83e72e203326fb40a0045135d88
Opcode Fuzzy Hash: e5ebaec09ba5177b595419b430e3d067e2b60e004ee5a1da4fa3f34ec1b44f95
Instruction Fuzzy Hash: D8213720508BC642E362873DC809797FF906B06334F08CBADD1FA495D3DBA4A255C382

Function 007DCCA0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 504e2131c1ba6f72152f79a71fad9284aa1909ece240ec49f83196bfcaf05598
Instruction ID: 3180cd3e9a09982fb3e9be83c4d72c95845bd6d0e67f3e5d8d03feb3825f19f5
Opcode Fuzzy Hash: 504e2131c1ba6f72152f79a71fad9284aa1909ece240ec49f83196bfcaf05598
Instruction Fuzzy Hash: 50214C20608BC642E366C73DD809797BFD16B46334F08CAADD1FA495D3DBB9A155C382

Function 007DCCA8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Strings

0sk, xrefs: 007DCDC3

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: 0sk
API String ID: 0-89697895
Opcode ID: 9b079d41173e4737670ba6899c2aa5c37d7b70d4070fd537b874c40069dfb9f2
Instruction ID: b76f86112460a8e431b676aacd4d863cd56ed706bd229fbdac961f0c078219ed
Opcode Fuzzy Hash: 9b079d41173e4737670ba6899c2aa5c37d7b70d4070fd537b874c40069dfb9f2
Instruction Fuzzy Hash: 38116A20608BC642E366873DD809797BF916B46334F08CBADD1FA495D3DBB8A154C382

Function 007DCCB8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Strings

0sk, xrefs: 007DCDC3

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: 0sk
API String ID: 0-89697895
Opcode ID: c5433ef8da994240315b4335664665c99d2901b282d8d51aa3e38f418acba425
Instruction ID: 2a7cf507e8b297e7ad33c6ef4c4710c9da0f4ef0fff83406070c7edeb0485086
Opcode Fuzzy Hash: c5433ef8da994240315b4335664665c99d2901b282d8d51aa3e38f418acba425
Instruction Fuzzy Hash: EA119D21A08B8646E325873DC809B97BF906F46334F08C76DD1FA495D3EBB4A154C382

Function 007DCCC0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Strings

0sk, xrefs: 007DCDC3

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: 0sk
API String ID: 0-89697895
Opcode ID: 8c4e35f35c0e79b5cebcb2298520ae9cf771b6e9ae703392d727d3f4dd1f0900
Instruction ID: 8f4cae70a98aa6b541aff834eb6655e0720ee8147c458f9589705547b9707303
Opcode Fuzzy Hash: 8c4e35f35c0e79b5cebcb2298520ae9cf771b6e9ae703392d727d3f4dd1f0900
Instruction Fuzzy Hash: 56119131A08B8656E325873DC805797BB906F46334F04C76DD1FA495D3D7B4A154C386

Function 007043C0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9cbc7f7bfdf23066968fc2e56befe3aae15ecbac89b9c4387f9be3f21397580
Instruction ID: 6990f0173f0c719ec72ffd258b9b4625926faeffeb95c8741194d5928a8169d4
Opcode Fuzzy Hash: e9cbc7f7bfdf23066968fc2e56befe3aae15ecbac89b9c4387f9be3f21397580
Instruction Fuzzy Hash: 75D06C705143019FCA46DF20D190866F7B1EF8A211F02E688D449ABA68D778EA88CB55

Function 0079C510 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2178eeb02326fb70e003c90e8cf0c6af30b7eec6b681a451a254f2d9bb70510c
Instruction ID: e0677a5a359e6f8f868840db47d58da2bf60d5ad5f9a33f79f92eb6480f7a126
Opcode Fuzzy Hash: 2178eeb02326fb70e003c90e8cf0c6af30b7eec6b681a451a254f2d9bb70510c
Instruction Fuzzy Hash:

Function 0093CB4E Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0093CC6D
CatchIt.LIBVCRUNTIME ref: 0093CDCC
_UnwindNestedFrames.LIBCMT ref: 0093CECD
CallUnexpected.LIBVCRUNTIME ref: 0093CEE8

Strings

csm, xrefs: 0093CB8B
csm, xrefs: 0093CBF8
csm, xrefs: 0093CCA4

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: CallCatchFramesNestedUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2332921423-393685449
Opcode ID: f5f618d9c5c8f358f906dac7117030498165ea16130a77751a8b1a6f2c90bd16
Instruction ID: a0111304f6f66c537b6100f0a6e14e81ee7d855bc91c31f57e35c5dd56d3ea19
Opcode Fuzzy Hash: f5f618d9c5c8f358f906dac7117030498165ea16130a77751a8b1a6f2c90bd16
Instruction Fuzzy Hash: 7EB18AB6800A19EFCF24DFA4D881AAEBBB9BF48310F14455AE8157B216D331DE11CF91

Function 0093C2D7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0093C2F3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0093C30C

Strings

p/}, xrefs: 0093C2E4

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: Value___vcrt_
String ID: p/}
API String ID: 1426506684-2534966446
Opcode ID: a29b7b9ea661f2a59ce2253f3ccf9a560f2121bbadac803c633b3afbafe240e0
Instruction ID: a07a5fd7ce991273ed9c1400ef89af7a6c912943b50c858b2e378fb7a0edbb7c
Opcode Fuzzy Hash: a29b7b9ea661f2a59ce2253f3ccf9a560f2121bbadac803c633b3afbafe240e0
Instruction Fuzzy Hash: 8C01F772209A125EA6242779BC99E6737D8EB027B8F20433AF124611F6EF519C029B94

Function 0094C07C Relevance: 7.7, APIs: 5, Instructions: 248COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 0094C2B7
__freea.LIBCMT ref: 0094C2BD
__freea.LIBCMT ref: 0094C2F3
__freea.LIBCMT ref: 0094C2F9
__freea.LIBCMT ref: 0094C309

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: __freea
String ID:
API String ID: 240046367-0
Opcode ID: e0ad1a3a4211deb22e101f1f7f26df25652b5fafc708527d246872cb3e4fa579
Instruction ID: 12317e34f3434bd66acaac8fc27fe8bb13319b8e7cff550cf71dde1df2b3183b
Opcode Fuzzy Hash: e0ad1a3a4211deb22e101f1f7f26df25652b5fafc708527d246872cb3e4fa579
Instruction Fuzzy Hash: CD71F6B29052099FDF619FA4CC81FAF77BA9F89714F244419F914A7282DB75DC00C7A0

Function 00941090 Relevance: 7.7, APIs: 5, Instructions: 178COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 009410FB
operator+.LIBVCRUNTIME ref: 0094114B
shared_ptr.LIBCMT ref: 00941217
DName::DName.LIBVCRUNTIME ref: 00941247
operator+.LIBVCRUNTIME ref: 009412A8

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: operator+shared_ptr$NameName::
String ID:
API String ID: 2894330373-0
Opcode ID: b02e3935563c88d6a84815ccc8162ee37ad82b1964995736a508fc5abb8f4226
Instruction ID: 8bd1278d65238ad4fca633fea08478285621f040809027320fec7e7cbfb44f5a
Opcode Fuzzy Hash: b02e3935563c88d6a84815ccc8162ee37ad82b1964995736a508fc5abb8f4226
Instruction Fuzzy Hash: 5761B27180810AEFCB14CFA8D844EBD7BB8FF48304F58865AE525DB650E7759A85CF84

Function 007D49B0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 354COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 007D49E3
_strlen.LIBCMT ref: 007D4BD1

Strings

:, xrefs: 007D4D7D

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: _strlen
String ID: :
API String ID: 4218353326-336475711
Opcode ID: 370a9e0d4ab9f5b63bf6ffb903fdf2c66b591bed5e57389467dc1b5159cf833a
Instruction ID: 14d74b085e0894e0656934db66ec7391accc8352f4bf6c0e1750f8268fe1799b
Opcode Fuzzy Hash: 370a9e0d4ab9f5b63bf6ffb903fdf2c66b591bed5e57389467dc1b5159cf833a
Instruction Fuzzy Hash: 96C127B4E002149FDB14DB64D895ABE7BB9FF59304F14402DF805A7392EB79AC05CBA2

Function 0081C3A0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0081C3E5
_strlen.LIBCMT ref: 0081C4F8

Strings

d, xrefs: 0081C700

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: _strlen
String ID: d
API String ID: 4218353326-2564639436
Opcode ID: 18fdc63775c4f28765f7ed6cb1c0f91bbe6adeac146d856bdc994aa4cb5f6ebd
Instruction ID: 6004a386719a02d88c94c0e34b44d684f9087d4d1e436d0d90916bab5a29a24b
Opcode Fuzzy Hash: 18fdc63775c4f28765f7ed6cb1c0f91bbe6adeac146d856bdc994aa4cb5f6ebd
Instruction Fuzzy Hash: 60B145B1A087509BD714CF29C4416ABBBE9FF89704F00892EF999D7241E371E985CF82

Function 0093C7DE Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0093CA55

Strings

csm, xrefs: 0093CAE8
csm, xrefs: 0093CA77
p/}, xrefs: 0093CA51

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm$p/}
API String ID: 3493665558-2909375355
Opcode ID: 89155b59d81e62785d3471a37a4e4cfae69de842a00f9afc2ef498449e6d002a
Instruction ID: d030683ce8b373de01057eec22964e404d5ed10dabc5a09c99892fbabe1a55dc
Opcode Fuzzy Hash: 89155b59d81e62785d3471a37a4e4cfae69de842a00f9afc2ef498449e6d002a
Instruction Fuzzy Hash: 0031F5B2404A0AEBCF269F94DC4696BBB7AFF08315F18855AF814A9121D332CC61DF81

Function 00A8CA20 Relevance: 6.4, Strings: 5, Instructions: 158COMMON

Download Yara Rule

Strings

exce, xrefs: 00A8CA4C
rsio, xrefs: 00A8CA61
mit , xrefs: 00A8CA53
eded, xrefs: 00A8CA45
n li, xrefs: 00A8CA5A

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID:
String ID: eded$exce$mit $n li$rsio
API String ID: 0-3272366112
Opcode ID: 0d52aab6427f1fb21a0a40bd63ac73ca46e36205e4b2c708a30f5b7ffb34a943
Instruction ID: 18e8ba9146990caa87e40a3943d1a6f5bcab249dbd686b7051d511bd96476c62
Opcode Fuzzy Hash: 0d52aab6427f1fb21a0a40bd63ac73ca46e36205e4b2c708a30f5b7ffb34a943
Instruction Fuzzy Hash: 0C51D6B1A003099FEB10AF64EC46BAA77B5FF45314F044078F90997292EB71DA55CFA2

Function 0093C875 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0093C93C
___AdjustPointer.LIBCMT ref: 0093C95F
___AdjustPointer.LIBCMT ref: 0093C9FB

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: eb9395385da5ccd17f9cb267cd9c2ea37512c0dc7b30f3bce129864ff1a4e59c
Instruction ID: a0548b14ef49c88cd3c3ab8274926fceb954fbebe755ce21d686d834fee3da7e
Opcode Fuzzy Hash: eb9395385da5ccd17f9cb267cd9c2ea37512c0dc7b30f3bce129864ff1a4e59c
Instruction Fuzzy Hash: 6051E2FA601A16AFDB289F14D841B7AB3A8FF80310F15452DE806A72A1D735ED80CF91

Function 007843E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 007844ED
_strlen.LIBCMT ref: 0078541F

Strings

|$K, xrefs: 007845A1
User, xrefs: 00784496

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: _strlen
String ID: User$|$K
API String ID: 4218353326-470947288
Opcode ID: 82d8b8ed3a9258aed911ad84b0183b64da3a274ced4f4386e407c3cfcd486e81
Instruction ID: fb33fbbbfc8a1718e745e7f28f97a269fbea131c224d1048be7c21cc296ff4b1
Opcode Fuzzy Hash: 82d8b8ed3a9258aed911ad84b0183b64da3a274ced4f4386e407c3cfcd486e81
Instruction Fuzzy Hash: AE61FBB1E402549BDB31BB249C06BEE77B5AF55700F0400A8F84DA7242FB785E44CBD2

Function 0093CF73 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

CatchIt.LIBVCRUNTIME ref: 0093D07E

Strings

RCC, xrefs: 0093CFB2
MOC, xrefs: 0093CFAA

Memory Dump Source

Source File: 00000000.00000002.2726122151.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2726107455.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726366801.0000000000AD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726422316.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726438741.0000000000BA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BA1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2726453523.0000000000BAC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_5vBN4LO7PH.jbxd

Similarity

API ID: Catch
String ID: MOC$RCC
API String ID: 78271584-2084237596
Opcode ID: 22907e4c23cd4d22bb7542f143889ee78e71f687916c1e59a3996a309aad2d54
Instruction ID: 547fac79ea83d75e864b038d69491c50483cb5333b24f9e456e0934a1479bd6b
Opcode Fuzzy Hash: 22907e4c23cd4d22bb7542f143889ee78e71f687916c1e59a3996a309aad2d54
Instruction Fuzzy Hash: 6B415971901209EFCF16DF98D981AAE7BBABF48300F148059F904B6265D3359951DF50

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5vBN4LO7PH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: 5vBN4LO7PH.exePID: 4940, Parent PID: 4084

General

Chronological Activities

Disassembly

Analysis Process: 5vBN4LO7PH.exePID: 4940, Parent PID: 4084COMMON

Non-executed Functions

Function 00730880 Relevance: 16.4, APIs: 1, Strings: 7, Instructions: 2379COMMON

Function 0079C620 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 522COMMON

Windows Analysis Report
5vBN4LO7PH.exe